CVE-2025-66030: node-forge ASN.1 OID integer overflow

CVE-2025-66030 · Severity: medium · CVSS 5.3 · Published 2025-11-26

node-forge is a cryptography library used by applications to parse and validate digital certificates and other cryptographic structures. A flaw in its ASN.1 OID (Object Identifier) parsing allows attackers to craft malicious certificates where large OID values silently overflow and are misinterpreted as legitimate, trusted OIDs. This could enable attackers to bypass certificate validation checks and forge trusted credentials.

Technologies: Digitalbazaar Forge, node-forge (npm). Vendors: Digitalbazaar, npm.

Quick answers

Is CVE-2025-66030 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66030 being exploited in the wild.
How severe is CVE-2025-66030?
Medium severity, with a CVSS score of 5.3, published 26 November 2025.
Which products and versions are affected?
node-forge (npm) SEMVER:introduced=0,fixed=1.3.2.
Is there a fix for CVE-2025-66030?
Yes. node-forge (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66030 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-66030?
Check whether you run Digitalbazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • node-forge (npm): upgrade to 1.3.2 or later
    npm install node-forge@1.3.2

Technical details

The vulnerability is an integer overflow (CWE-190) in the asn1.derToOid function within forge/lib/asn1.js. OID arc components are decoded using JavaScript's bitwise left-shift operator (<<), which forcibly truncates values to 32-bit signed integers. When an attacker provides an OID arc exceeding 2^31-1, the value silently wraps around rather than raising an error, allowing a malicious, oversized OID to be misinterpreted as a smaller, trusted OID. The attack is network-based and requires no authentication; the attacker simply needs to craft and transmit a malicious ASN.1 structure containing the oversized OID. This allows bypass of OID-based security decisions in downstream applications, potentially compromising the integrity of certificate validation. The vulnerability is fixed in node-forge version 1.3.2.

Affected products

  • Digital Bazaar node-forge < 1.3.2

Identifiers

  • CVE-2025-66030
  • GHSA-65ch-62r8-g69g

Timeline

  • 2025-11-26: disclosed
  • 2025-11-26: patched: Version 1.3.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.