CVE-2026-27452

critical · 9.2

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6.

9.2

CVSS

0.3%

EPSS (exploit prob.)

18th

EPSS percentile

2026-02-21

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
jonathanwilbur	asn1-ts	< 11.0.6

Check a specific version with /api/v1/cve/match.

References

https://github.com/JonathanWilbur/asn1-ts/security/advisories/GHSA-h5rw-vxjr-8q79

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-27452