CVE-2025-66031: node-forge Uncontrolled Recursion Vulnerability Leading to Denial-of-Service
Summary
CVE-2025-66031: node-forge has ASN.1 Unbounded Recursion. Affects node-forge versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-forge is a popular JavaScript library used for implementing cryptographic functions and protocols, including TLS and certificate parsing. It provides a variety of tools for handling cryptographic operations in Node.js applications. However, certain versions of node-forge are vulnerable to a specific issue that can be exploited by attackers to cause significant disruptions in service.
Vulnerability Detail
An Uncontrolled Recursion vulnerability (CWE-674) exists in node-forge versions 1.3.1 and below, specifically in the asn1.fromDer function. This vulnerability allows remote, unauthenticated attackers to create deeply nested ASN.1 structures that trigger unbounded recursive parsing. The lack of a guard limiting recursion depth in the ASN.1 DER parser implementation (_fromDer) can lead to stack exhaustion, resulting in a Denial-of-Service (DoS) condition. When untrusted DER inputs are parsed, the Node.js V8 engine may exhaust its call stack, causing it to throw a RangeError: Maximum call stack size exceeded, which can crash or incapacitate the process handling the parse. This vulnerability poses a significant risk to applications that rely on node-forge for TLS connections or certificate parsing.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install node-forge@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
npm install node-forge@1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to restrict the depth of ASN.1 structures being parsed. This can help mitigate the risk of triggering the vulnerability until an update can be applied.
Conclusion
The CVE-2025-66031 vulnerability in node-forge poses a significant risk of Denial-of-Service attacks due to uncontrolled recursion in ASN.1 parsing. It is crucial for developers using this library to update to version 1.3.2 or later to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-forge →
FAQ
The vulnerability is an uncontrolled recursion issue that can lead to Denial-of-Service attacks by exhausting the call stack when parsing deeply nested ASN.1 structures.
node-forge versions 1.3.1 and below are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
Implement input validation to restrict the depth of ASN.1 structures being parsed as a temporary workaround until you can update the package.
You can find detailed information about this vulnerability in the GitHub advisory database or by visiting the node-forge GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-forge.
