REDHAT-BUG-2417097: High severity npm/node-forge vulnerability

Q: Which deployments are exposed to this issue?

Deployments using npm/node-forge version 1.3.1 or earlier are affected. The issue can affect applications that process attacker-controlled ASN.1 structures and rely on downstream cryptographic verification or security decisions.

Q: Does exploitation require authentication?

No. The vulnerability is described as exploitable by unauthenticated attackers who can craft ASN.1 structures.

Q: What security impact should triage teams consider?

The interpretation conflict can desynchronize schema validation from later processing, creating a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Published Nov 25, 2025

Updated

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Affected Software

1 affected component

npm/node-forge<=1.3.1

Event History

Nov 25, 2025

Data Sourced

via Red Hat·08:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using npm/node-forge version 1.3.1 or earlier are affected. The issue can affect applications that process attacker-controlled ASN.1 structures and rely on downstream cryptographic verification or security decisions.

Does exploitation require authentication?

No. The vulnerability is described as exploitable by unauthenticated attackers who can craft ASN.1 structures.

What security impact should triage teams consider?

The interpretation conflict can desynchronize schema validation from later processing, creating a semantic divergence that may bypass downstream cryptographic verifications and security decisions.