Is CVE-2025-66031 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66031 being exploited in the wild.

How severe is CVE-2025-66031?

High severity, with a CVSS score of 7.5, published 26 November 2025.

Which products and versions are affected?

node-forge (npm) SEMVER:introduced=0,fixed=1.3.2.

Is there a fix for CVE-2025-66031?

Yes. node-forge (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66031 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66031?

Check whether you run Digitalbazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66031: node-forge ASN.1 unbounded recursion denial of service

CVE-2025-66031 · Severity: high · CVSS 7.5 · Published 2025-11-26

node-forge is a cryptography library used in Node.js applications to handle TLS connections and certificate parsing. An attacker can crash servers or clients by sending specially crafted ASN.1 structures that trigger excessive recursion, causing the process to exhaust its call stack and become unavailable. This affects any application using node-forge to process untrusted certificate or cryptographic data.

Technologies: Digitalbazaar Forge, node-forge (npm). Vendors: Digitalbazaar, npm.

Quick answers

Is CVE-2025-66031 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66031 being exploited in the wild.
How severe is CVE-2025-66031?: High severity, with a CVSS score of 7.5, published 26 November 2025.
Which products and versions are affected?: node-forge (npm) SEMVER:introduced=0,fixed=1.3.2.
Is there a fix for CVE-2025-66031?: Yes. node-forge (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66031 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66031?: Check whether you run Digitalbazaar Forge or node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.3.2 or later
```
npm install node-forge@1.3.2
```

Technical details

An uncontrolled recursion vulnerability (CWE-674) exists in the node-forge asn1.fromDer function within lib/asn1.js. The ASN.1 DER parser (_fromDer) recursively processes constructed types (SEQUENCE, SET, etc.) without enforcing a depth limit. An attacker can craft a small DER blob with deeply nested constructed TLV (Tag-Length-Value) structures that causes the Node.js V8 engine to exhaust its call stack, throwing "RangeError: Maximum call stack size exceeded" and crashing the process. This is a remote, unauthenticated denial-of-service attack requiring no special privileges or user interaction. The vulnerability affects node-forge versions 1.3.1 and earlier; a fix was released in version 1.3.2 by adding recursion depth limits.

Affected products

Digital Bazaar node-forge < 1.3.2

Identifiers

CVE-2025-66031
GHSA-554w-wpv2-vw27

Timeline

2025-11-26: disclosed: GHSA-554w-wpv2-vw27 published
2025-11-26: patched: Fix released in version 1.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.