CVE-2025-66030
Medium
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
SeverityMedium
CVSS5.3
Exploit probability—
ProductDigitalbazaar Forge
PublishedNov 26, 2025
First seenNov 26, 2025
Weakness typeCWE-190Integer overflow
How to fix
Update
- digitalbazaar forge1.3.2 or later
- node-forge1.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digitalbazaar forge | v < 1.3.2 | 1.3.2 |
| node-forgenpm | v < 1.3.2 | 1.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.