Integer Overflow Vulnerability in Node-Forge Library Affecting Digital Bazaar
CVE-2025-66030

6.3MEDIUM

Key Information:

Vendor

Digitalbazaar

Status
Forge
Vendor
CVE Published:
26 November 2025

What is CVE-2025-66030?

An Integer Overflow vulnerability in the node-forge library allows remote attackers to exploit oversized ASN.1 structures containing Object Identifiers (OIDs). This flaw results from 32-bit bitwise truncation, which may cause the system to interpret larger OIDs as smaller, legitimate ones. As a result, attackers can bypass critical security mechanisms that depend on OID validation. This vulnerability affects node-forge versions up to 1.3.1, with a fix implemented in version 1.3.2.

Affected Version(s)

forge < 1.3.2

References

https://github.com/digitalbazaar/forge/security/advisorie...
x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/commit/3e0c35ace16...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.