Executive brief
node-forge is a cryptography library used by applications to parse and validate digital certificates and other cryptographic structures. A flaw in its ASN.1 OID (Object Identifier) parsing allows attackers to craft malicious certificates where large OID values silently overflow and are misinterpreted as legitimate, trusted OIDs. This could enable attackers to bypass certificate validation checks and forge trusted credentials.
Technical details
The vulnerability is an integer overflow (CWE-190) in the asn1.derToOid function within forge/lib/asn1.js. OID arc components are decoded using JavaScript's bitwise left-shift operator (<<), which forcibly truncates values to 32-bit signed integers. When an attacker provides an OID arc exceeding 2^31-1, the value silently wraps around rather than raising an error, allowing a malicious, oversized OID to be misinterpreted as a smaller, trusted OID. The attack is network-based and requires no authentication; the attacker simply needs to craft and transmit a malicious ASN.1 structure containing the oversized OID. This allows bypass of OID-based security decisions in downstream applications, potentially compromising the integrity of certificate validation. The vulnerability is fixed in node-forge version 1.3.2.
Affected products
- Digital Bazaar node-forge < 1.3.2
Timeline
- 2025-11-26: disclosed
- 2025-11-26: patched: Version 1.3.2 released