CVE-2025-66031 — node-forge ASN.1 Unbounded Recursion
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and b…
Published: 2025-11-26 · CVSS: 8.7 · CVSS 4.0
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7