CVE-2025-66030: node-forge is vulnerable to ASN.1 OID Integer Truncation

November 26, 2025 (updated December 1, 2025)

MITRE-Formatted CVE Description An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.

References

github.com/advisories/GHSA-65ch-62r8-g69g
github.com/digitalbazaar/forge
github.com/digitalbazaar/forge/commit/3e0c35ace169cfca529a3e547a7848dc7bf57fdb
github.com/digitalbazaar/forge/security/advisories/GHSA-65ch-62r8-g69g
nvd.nist.gov/vuln/detail/CVE-2025-66030

Code Behaviors & Features

Detect and mitigate CVE-2025-66030 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →