CVE-2025-66031 - CVE House
Back to Database
Status published High CVE-2025-66031

node-forge ASN.1 Unbounded Recursion

Vulnerability Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66031

Credits & Attribution

No credits recorded in the NVD database.

References

More from digitalbazaar

View All →
CVE-2025-66030
node-forge ASN.1 OID Integer Truncation
Medium 6.3
CVE-2024-31995
zcap has incomplete expiration checks in capability chains.
Medium 4.3
CVE-2022-24773
Improper Verification of Cryptographic Signature in `node-forge`
Medium 5.3
CVE-2022-24772
Improper Verification of Cryptographic Signature in `node-forge`
High 7.5
CVE-2022-24771
Improper Verification of Cryptographic Signature in node-forge
High 7.5

Affected Vendor

digitalbazaar

View all reports →

Affected Software

forge
Vulnerable Versions:
< 1.3.2

Timeline

Official Publish: November 26th, 2025
Last Modified: November 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-674

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.