8.6

CVE-2025-12816: CVE-2025-12816

Analyzed
AliasesUBUNTU-CVE-2025-12816DEBIAN-CVE-2025-12816CGA-24rj-v7pf-f262
Published 25-11-2025Last modified 25-11-2025

Vulnerability summary

CVE-2025-12816 is a high (CVSS 8.6) Interpretation Conflict vulnerability in digital bazaar forge. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.7% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
0.58%
0%100%
Low · -0.16 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 6 · Related 14
OPENSUSE-SU-2026:20177-1SUSE-SU-2026:0628-1SUSE-SU-2026:0630-1SUSE-SU-2026:1008-1SUSE-SU-2026:1013-1SUSE-SU-2026:20232-1

Timeline

  1. 25-11-2025
    PublishedVulnerability first disclosed.
  2. 25-11-2025
    Last modifiedVulnerability information updated.

Description

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

Decrease -0.16 pp

From 0.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Forge

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard133 products
  • arangodb-3.11< 3.11.14.4-r10
  • arangodb-3.12< 3.12.9.4-r4
  • argo-workflow-cli-3.6< 3.6.13-r2
  • argo-workflow-cli-3.7< 3.7.4-r2
  • argo-workflow-controller-3.6< 3.6.13-r2
Wolfi48 products
  • argo-workflow-cli-3.7< 3.7.4-r2
  • argo-workflow-controller-3.7< 3.7.4-r2
  • argo-workflow-controller-3.7-compat< 3.7.4-r2
  • argo-workflow-executor-3.7< 3.7.4-r2
  • argo-workflow-executor-3.7-compat< 3.7.4-r2
Digital bazaar2 products
Debian1 product
  • node-node-forgeAll versions (No fix recorded)
Digitalbazaar1 product
Npm1 product
  • node-forge< 1.3.2
Ubuntu1 product
  • node-node-forgeAll versions (No fix recorded)

7 vendors · 187 products

References

18 links
Show all 18 references