The vulnerability of the asn1.validate() function in the Forge/lib/asn1.js set of cryptographic tools and tools for developing web applications allows a perpetrator to circumvent security restrictions.

🗓️ 08 Dec 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Vulnerability in asn1.validate() in Forge/lib/asn1.js enables remote security bypass via ASN.1 interpretation.

Reporter	Title	Published	Views	Family All 125
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile is affected by multiple security vulnerabilties	22 May 202622:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	6 Feb 202617:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in DataStage on Cloud Pak for Data	25 Feb 202616:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2026.	27 Mar 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	26 Feb 202610:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses node-forge which is vulnerable to CVE-2025-12816	30 Jan 202608:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx.data integration (Data Observability) is vulnerable to node-forge-1.3.1.tgz due to CVE-2025-12816 ( CVE number(s) )	27 Apr 202609:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	26 Feb 202603:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses node-forge-1.3.1.tgz,aiohttp-3.13.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl and WebSphere Application Server v.25.0.0.10 which is vulnerable to multiple CVEs.	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities in node.js packages affect IBM Voice Gateway	2 Dec 202516:28	–	ibm

Vulners

Node

digital_bazaar,forgeRange<1.3.2

Source	Link
github	www.github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq
kb	www.kb.cert.org/vuls/id/521113
github	www.github.com/microsoft/azurelinux/pull/15208
github	www.github.com/digitalbazaar/forge/pull/1124
web	www.web.nvd.nist.gov/view/vuln/detail

12 Jan 2026 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 27.8

CVSS 38.6

EPSS0.00705

Abstract Syntax Notation One Remote bypass Forge toolkit Security vulnerability Cryptography tool