CVE-2025-66031: node-forge has ASN.1 Unbounded Recursion

November 26, 2025

An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.

References

github.com/advisories/GHSA-554w-wpv2-vw27
github.com/digitalbazaar/forge
github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451
github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27
nvd.nist.gov/vuln/detail/CVE-2025-66031

Code Behaviors & Features

Detect and mitigate CVE-2025-66031 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →