VDB
RHSA-2026:1248
RHSA-2026:1248
PUBLISHED
CVSS 8.699999809265137 HIGH
A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
Risk Scores
CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-controller-rhel9@sha256:14619f0de60c7891791301fb7e76c047568d0e88b6013e2023bf1a7fbae71a32_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:5d385ba67a8d8158790da4511586c190a24a194e2ccb10fcb7182b658a59c624_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:3272d2ec42f5bb575940b8c9b1704e7d8e79a702f6e46d8378e08f1a1177fa15_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9@sha256:45f60e1dbd38452d10c49fe21e679b3847c4837a624a4ea8f6f90cf3c74ab236_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-ova-provider-server-rhel9@sha256:b5ee12762ea91d7eda83b5e28badc751d1813d09e7b962a2b6d6e3be46b99ecd_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-rhel9-operator@sha256:b2493c389b48661df00e07d78f5af247f7a8254b88ed0d2cf6c29813bb63d802_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:22534de48fae928bfce581b6d893318c94530646d9bebf05b280abfcd1bed7dc_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:8fabdc787bbda9a68c11c3a5cfbd6a7c4a71946ad04df996ab5480203f5858ab_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9@sha256:39994efa887e6269f26710c85939dc00241fa898a52db5d6d34f4bf8ca87c39d_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9@sha256:487ad1c29aa180f6f76a74b87c285363aedcf87dadf00bde599a2ebf3790156d_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
| Red Hat | registry.redhat.io/migration-toolkit-virtualization/mtv-operator-bundle@sha256:f744b3832d6f2232b9dd605ff0ca8934acf279e8f065150d0a170104b290271e_amd64 as a component of Migration Toolkit for Virtualization 2.9 | * |
Timeline
- Jan 26, 2026 CVE Published
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:1248 advisory
- https://access.redhat.com/security/cve/CVE-2025-12816 advisory
- https://access.redhat.com/security/cve/CVE-2025-66031 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/migration_toolkit_for_virtualization advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1248.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2417097 issue
- https://www.cve.org/CVERecord?id=CVE-2025-12816 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-12816 advisory
- https://github.com/digitalbazaar/forge advisory
- https://github.com/digitalbazaar/forge/pull/1124 advisory
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq advisory
- https://kb.cert.org/vuls/id/521113 advisory
- https://www.npmjs.com/package/node-forge advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2417397 issue
- https://www.cve.org/CVERecord?id=CVE-2025-66031 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66031 advisory
- https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451 advisory
- https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27 advisory