Critical node-forge Flaw (CVE-2025-12816) Allows Signature Verification Bypass via ASN.1 Manipulation (21M Downloads/Week)

A critical vulnerability (CVE-2025-12816) has been identified in the node-forge JavaScript library, which is widely used and receives approximately 21 million downloads weekly. This flaw allows attackers to bypass signature verification by manipulating ASN.1-encoded data structures, potentially leading to authentication bypass and data tampering. The vulnerability affects systems relying on node-forge for validating X.509 certificates, PKCS#7 messages, and PKCS#12 secure containers.

CERT/CC warns that crafted ASN.1 data can trick applications into accepting forged data as legitimate, posing risks such as impersonation and acceptance of tampered software. A patch (version 1.3.2) has been released, and developers are urged to update immediately.