Security Digest: November 26, 2025 - 2 Critical Vulnerabilities
Today's highlighted vulnerabilities include a critical ASN.1 validation bypass in node-forge and a Regular Expression Denial of Service (ReDoS) vulnerability in Valibot.
· 3 min read
Critical Security Threats Detected: Immediate Actions Required
Today, two high-severity vulnerabilities have been reported affecting widely-used npm packages. These vulnerabilities could allow attackers to bypass cryptographic validations or cause service disruptions. Immediate action is essential to safeguard your systems.
Executive Summary
Today's highlighted vulnerabilities include a critical ASN.1 validation bypass in node-forge and a Regular Expression Denial of Service (ReDoS) vulnerability in Valibot. Both vulnerabilities require urgent patching to prevent potential exploitation that could lead to data integrity breaches or service outages.
Critical Vulnerabilities
- CVE-2025-12816: ASN.1 Validation Bypass in node-forge
- Impact: Allows attackers to bypass cryptographic verifications, potentially compromising data integrity.
- Affected Systems: node-forge versions 1.3.1 and below.
- Immediate Action: Upgrade to node-forge version 1.3.2 immediately.
- Mitigation: Review and ensure all dependencies are updated to the latest secure versions.
- CVE-2025-66020: ReDoS Vulnerability in Valibot Emoji Validation
- Impact: Enables denial of service attacks via crafted input, leading to resource exhaustion.
- Affected Systems: Projects using Valibot's emoji validation.
- Immediate Action: Apply the latest patch to modify the EMOJI_REGEX and prevent overlapping character classes.
- Mitigation: Implement input validation checks and monitor for unusual activity.
What to Do Now
- Immediately upgrade node-forge to version 1.3.2 and apply the patched regex in Valibot.
- Verify that all systems using these libraries are updated to the latest versions.
- Monitor server logs for any signs of attempted exploits or unusual activity.