CVE-2025-12816
Aliases:GHSA-5gfm-wpxj-wjgqDEBIAN-CVE-2025-12816CGA-24rj-v7pf-f262CGA-2632-qf39-6m5pCGA-34g7-69hw-q3hmCGA-34wx-vrf6-xjh7CGA-3fcv-xc6q-f433CGA-3mj6-3j3c-mm32CGA-3p85-qghv-m9qhCGA-3qp6-4f69-m6fhCGA-48x5-r65v-vxcrCGA-4cpx-rrcg-jf3wCGA-4h3c-xcvc-6x2gCGA-526v-782p-g2h9CGA-54v8-j872-8m33CGA-5746-666f-v26pCGA-58v9-rfwh-phqvCGA-5r8q-755r-cg7pCGA-5w22-c55x-qjj9CGA-5x7c-9wmh-4j87CGA-623g-hxc9-jfh5CGA-64fj-hg2c-6j53CGA-67w6-gg52-gpv8CGA-6hrp-9j2r-g6fcCGA-6j27-q3r7-wjqmCGA-6xjf-4xj3-78p2CGA-7396-hc55-jgwhCGA-7hp6-wr3f-j45mCGA-7hrh-g6vq-chrfCGA-7mr5-q48w-89gpCGA-7pgq-fj46-gmr3CGA-7qqc-78qp-w939CGA-82p7-2c79-v9hhCGA-8436-9h86-jrg4CGA-8hr8-962w-rp3gCGA-92jv-4wr2-q8p7CGA-93qp-pxp2-cw42CGA-9fjh-hw8c-mg49CGA-9fp4-v58v-jp22CGA-9fr5-ppx2-9h68CGA-9hgw-j82v-wcm7CGA-9hr6-vg5m-jwhwCGA-c4rv-4jrv-xqf6CGA-c5mm-rr4x-q22fCGA-c75m-6fcg-9f66CGA-c7h2-r6r4-fm4vCGA-cfj2-74vv-c9rxCGA-cp4c-qhc9-8gg5CGA-cp5j-5jqr-pmqxCGA-cx5x-chq8-2rcqCGA-fc4h-9rpc-mq47CGA-fq4m-grjr-79x2CGA-fxr8-5hxc-jxc3CGA-g4p6-wccj-q3vjCGA-g4qv-5xrx-frq3CGA-g6h9-fr9j-99c8CGA-gcpm-3xmx-xwp7CGA-ggqg-pcgg-qq3hCGA-gh4w-5289-6p53CGA-gw4f-3jpw-2cj8CGA-h4fx-cvgg-5g2fCGA-h7gp-5vg6-cm54CGA-h8q5-4rp2-cx3hCGA-hf99-g2wj-752hCGA-hfj6-h2q6-hq8rCGA-hjv8-j3x4-c7gcCGA-j5mj-2rg8-p495CGA-jg9v-xxr6-pjjvCGA-jmp4-7p5x-46cxCGA-jrxm-35cc-464qCGA-mc6f-j8hc-5w8wCGA-mm42-xp4h-46w7CGA-mx8j-58cg-pwfvCGA-p5mg-74fh-x7v5CGA-p69c-wc28-c68jCGA-p76p-68qp-cm8mCGA-pv47-x6fp-g6mqCGA-pwqx-vmcx-gr74CGA-px43-r498-pw9qCGA-2275-wjj4-rpxmCGA-22q2-2v5p-h2jfCGA-258c-pxm6-5vvqCGA-26hc-4q52-wpv8CGA-2769-2jj8-447mCGA-2h76-g3p5-538qCGA-2mhj-9fvx-7q8mCGA-2vgr-qr35-8m3jCGA-2vpf-2m64-m8h4CGA-2vv4-v4w8-c7f6CGA-2w36-7jgj-46p9CGA-32j3-9ph3-9hfjCGA-339j-hwqg-q7r6CGA-34mg-r442-f35rCGA-367h-844m-qrvmCGA-36r5-vpmp-qp7jCGA-3cfh-vgmx-mcgxCGA-3cwg-3539-5427CGA-3mc7-65ph-wphfCGA-3mpj-vh62-r5x5CGA-3q65-2x5g-v8xxCGA-3wf3-c9x8-wj9xCGA-3wx6-89rv-4q7xCGA-4235-qv78-qp49CGA-454x-pjw6-7xh7CGA-47vv-33vf-cv48CGA-48xm-7xv2-8884CGA-52pf-r9x4-wrhqCGA-55x8-j6cj-3p7mCGA-56m7-rf7v-q55rCGA-57rx-2q29-97r3CGA-5qq8-6m6m-8qh9CGA-5vpc-xx3m-q74rCGA-5xxx-mqvh-3ww4CGA-64wj-m5q9-4g3hCGA-65wv-48xx-f6f2CGA-66qm-hxpm-862jCGA-6fmc-phwh-4qqjCGA-6g3g-7cxf-2488CGA-6h2h-g243-hqh5CGA-6m9p-wh6p-vmv5CGA-6x39-5x8w-q3rpCGA-6x6w-mj7r-6994CGA-6xvf-p98c-533fCGA-744p-wv8x-vrrmCGA-746w-jfvh-6gw3CGA-759q-5262-m45rCGA-76fg-c5m3-c75vCGA-7cc5-mf32-fhf9CGA-7cv2-w99v-pmpvCGA-7fx4-g7g2-8v6fCGA-7jr3-vcv3-fm7pCGA-7mc2-jc2f-97gfCGA-7wvr-hq74-4347CGA-7x66-p23j-g667CGA-85gf-mmxj-3c2cCGA-889h-pvhj-gmmrCGA-8wcw-r687-37jmCGA-92mr-xwc5-g553CGA-95x8-f255-4x85CGA-9c9p-fwhh-h9w8CGA-9g44-c953-87gpCGA-9w56-g2fv-m2g9CGA-9wvr-c573-v8wgCGA-9xxp-4r89-hg3qCGA-c26h-rh94-p324CGA-c569-9qhx-wr5rCGA-c69c-6pfq-vxq7CGA-ccr4-p9jj-v5hjCGA-cfvw-4m69-pvqgCGA-cp7p-jf5c-p3q7CGA-cx58-xr43-42hfCGA-f3wp-m2j5-rj6mCGA-f55g-pj2j-q33vCGA-f679-2gcq-xpvpCGA-f877-3h3q-4r52CGA-fhqf-jxgw-cp5cCGA-fp56-v7w3-x456CGA-fvqr-5hqx-x469CGA-g22r-5r55-p7v3CGA-g8vh-52rm-x7mwCGA-ggrm-p42m-c9m3CGA-ghhg-4h9v-47rjCGA-grrv-j5xc-g5vxCGA-gxpc-59fj-fgr7CGA-hf3m-784h-2c3jCGA-hhx7-2hm9-w377CGA-hqgw-5m4f-2qm4CGA-hv7f-c5h7-f7c7CGA-hx53-7w4m-8xr3CGA-j5c3-8chw-m7gjCGA-j6pr-f264-h2p8CGA-j74q-92j7-m4qqCGA-j7wg-8g75-x3wcCGA-j8jr-h7hr-4628CGA-jf8q-rr44-x2ggCGA-jh46-fjpf-6rx9CGA-jjvx-25wm-x24pCGA-jp7m-gcqj-v237CGA-jp94-q4cj-wmx5CGA-jpcf-72xm-c8g5CGA-jv63-f5cf-75vpCGA-jvf4-58q2-7cgjCGA-jx5q-mg84-v97pCGA-m2f8-vjv5-8xr4CGA-m9rp-xj9c-g2mhCGA-mcp8-qx3c-pgw6CGA-mfhr-r95p-vj4wCGA-mpqp-8rp2-pmc7CGA-mq8q-jv9f-9g86CGA-p28v-gpg4-f5mfCGA-pc3c-5gmr-wgj7CGA-pcqx-884q-cf9hCGA-pg64-h434-5fwwCGA-pg98-cwcx-3x55CGA-pjf6-qp4v-hqfxCGA-pmh4-cmhg-r8cjCGA-pmxq-r7vx-86x5CGA-pxm9-jw8f-j5pqCGA-pxmc-pj8w-3q34CGA-pxqc-hx86-37c8CGA-q5c8-qxcp-6784CGA-q5h3-rw93-crgwCGA-q5w4-q6wp-hwhfCGA-q7fr-3949-r86mCGA-q7gh-m6w6-vrxwCGA-qfmc-5vv3-7mcvCGA-qprg-qppf-w97rCGA-qq5v-664m-6g99CGA-qr68-94x6-4j7vCGA-qwhq-g3rf-px2hCGA-qxv3-653r-8v2pCGA-r2xr-967j-c4qrCGA-r557-4827-j4jpCGA-r982-m42m-8g97CGA-rf5f-c79c-6m6wCGA-rjhq-gc6r-gjg3CGA-rqfv-xf97-v3g8CGA-rrr6-33vf-4hpqCGA-rwj2-cr5g-975xCGA-rx63-f25r-pmh6CGA-rxxh-4xpm-x3xfCGA-rxxh-hxvf-57p6CGA-v2m5-98wj-8q32CGA-v5h7-qm32-h635CGA-v5hg-2vg3-vrwcCGA-v74f-9xcg-hcxmCGA-v7xq-2g3c-hq29CGA-v97m-v632-rp54CGA-vfjg-7c25-3v44CGA-vg7v-8q4c-gg44CGA-vmwc-qjvj-9986CGA-vprp-phhh-gpg4CGA-vr64-h9j9-55m2CGA-vv5p-vjw4-jgmxCGA-vvf2-vvxg-f6cqCGA-vvfv-6pqf-5wx3CGA-vw2p-g7mx-7wr4CGA-vw7v-vfcx-6gvgCGA-w8w3-j25v-fm3hCGA-wf3m-mp77-wjcwCGA-wg4g-mrv6-654vCGA-wr4f-cc53-869cCGA-x3wc-8jww-h47xCGA-x4mp-vpfw-2p64CGA-x5x6-32fw-j4fgCGA-x673-8mrc-p28jCGA-xfw5-xch5-wpw9CGA-xhwm-3x72-hcg3CGA-xm45-vxqf-v2f7CGA-xm9p-f8m7-qx8jCGA-xp73-rpr9-g33mCGA-xw6h-mmgm-8qv8CGA-3qj5-6h28-8hqpCGA-7r8x-2433-jcwr
Advisory lineage Upstream: 0 Downstream: 8
Analyzed
Published: 25 Nov 2025, 19:15
Last modified:25 Nov 2025, 21:04
Vulnerability Summary
Overall Risk (default)
medium
45/100 CVSS Score
8.6 HIGH
v3.1 (cve.org)
EPSS Score
0.74% LOW
1% probability +0.68%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
25 Nov 2025, 19:15
Published
Vulnerability first disclosed
25 Nov 2025, 21:04
Last Modified
Vulnerability information updated
Description
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- v3.1•HIGH•Score: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS Trends
Current EPSS score: 0.74%• Percentile: 53%
Techniques & Countermeasures
- CWE-436•Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Affected Systems
- chainguard•arangodb-3.11
< 3.11.14.4-r10
- chainguard•arangodb-3.12
< 3.12.9.4-r4
- chainguard•argo-workflow-cli-3.6
< 3.6.13-r2
- chainguard•argo-workflow-cli-3.7
< 3.7.4-r2
- chainguard•argo-workflow-controller-3.6
< 3.6.13-r2
- chainguard•argo-workflow-controller-3.6-compat
< 3.6.13-r2
- chainguard•argo-workflow-controller-3.7
< 3.7.4-r2
- chainguard•argo-workflow-controller-3.7-compat
< 3.7.4-r2
- chainguard•argo-workflow-executor-3.6
< 3.6.13-r2
- chainguard•argo-workflow-executor-3.6-compat
< 3.6.13-r2
- chainguard•argo-workflow-executor-3.7
< 3.7.4-r2
- chainguard•argo-workflow-executor-3.7-compat
< 3.7.4-r2
- chainguard•argo-workflows-3.6
< 3.6.13-r2
- chainguard•argo-workflows-3.7
< 3.7.4-r2
- chainguard•argo-workflows-known-hosts-3.6
< 3.6.13-r2
- chainguard•argo-workflows-known-hosts-3.7
< 3.7.4-r2
- chainguard•argo-workflows-ui-3.6
< 3.6.13-r2
- chainguard•argo-workflows-ui-3.7
< 3.7.4-r2
- chainguard•gitlab-rails-ce-18.1
< 18.1.6-r25
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.11
< 18.11.6-r7
- chainguard•gitlab-rails-ce-18.5
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
< 19.0.5-r1
- chainguard•gitlab-rails-ce-19.1
< 19.1.2-r6
- chainguard•gitlab-rails-ce-fips-18.1
< 18.1.6-r87
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.11
< 18.11.7-r1
- chainguard•gitlab-rails-ce-fips-18.5
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
< 19.0.4-r6
- chainguard•gitlab-rails-ce-fips-19.1
< 19.1.3-r2
- chainguard•gitlab-rails-ce-fips-19.2
< 19.2.1-r5
- chainguard•jitsucom-jitsu
< 2.11.0-r8
- chainguard•jitsucom-jitsu-console
< 2.11.0-r8
- chainguard•jitsucom-jitsu-rotor
< 2.11.0-r8
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
Showing first 50 affected entries in server-rendered view.
References (16)
- https://www.npmjs.com/package/node-forge
- https://github.com/digitalbazaar/forge/pull/1124
- https://github.com/digitalbazaar/forge
- https://kb.cert.org/vuls/id/521113
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq
- https://www.kb.cert.org/vuls/id/521113
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167
- https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667
- https://security-tracker.debian.org/tracker/CVE-2025-12816
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12816.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-12816