The vulnerability CVE-2025-12816 affects the node-forge library, which is used in Red Hat multicluster global hub 1.4.4. It arises from an interpretation conflict in ASN.1 (Abstract Syntax Notation One) structure parsing, allowing unauthenticated attackers to craft malicious ASN.1 structures that desynchronize schema validations. This semantic divergence enables bypassing downstream cryptographic verifications and security decisions. The issue is tracked under CWE-179 (Incorrect Behavior Order) and impacts the integrity and confidentiality of cryptographic operations. Red Hat has released version 1.4.4 with security fixes and updated container images to address this vulnerability. No alternative mitigations meeting Red Hat's criteria are currently available.

An unauthenticated attacker can exploit this vulnerability to bypass cryptographic verification mechanisms, potentially compromising the integrity and confidentiality of security decisions in affected Red Hat products using node-forge. This could lead to unauthorized actions or data manipulation within the multicluster global hub environment. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Red Hat has released updated images and security fixes in Red Hat multicluster global hub version 1.4.4 to address this vulnerability. Users should upgrade to this version or later to remediate the issue. Currently, no alternative mitigations that meet Red Hat's criteria for ease of use, deployment, and stability are available. Monitoring Red Hat advisories for further updates is recommended.