CVE-2025-66030CWE-190

CVE-2025-66030

Medium · published November 27, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2025-11-27T04:15Z
Affected products (1)
ProductVersionsFixed in
digitalbazaar/forge< 1.3.21.3.2
References (2)
https://github.com/digitalbazaar/forge/commit/3e0c35ace169cfca529a3e547a7848dc7bf57fdb · [email protected]https://github.com/digitalbazaar/forge/security/advisories/GHSA-65ch-62r8-g69g · [email protected]
EPSS history
Timeline
  • 26 NOV 22:23Z
    node-forge ASN.1 OID Integer Truncation
    cvelistv5