CVE-2025-66030: Integer Overflow in node-forge

An attacker can exploit this vulnerability by crafting malicious ASN.1 structures containing oversized OIDs. The asn1.derToOid function in node-forge performs a bitwise truncation, causing oversized OIDs to be decoded as smaller, trusted OIDs. This can lead to a bypass of security mechanisms that rely on OID validation, potentially allowing an attacker to impersonate legitimate entities or gain unauthorized access. The impact is particularly severe in applications that use node-forge for cryptographic operations or secure communication, as it could compromise the integrity of the entire system. The truncation effectively allows an attacker to masquerade as a trusted entity by crafting an OID that, after truncation, matches a legitimate, trusted OID.

1. Reserved2025-11-21
2. Published2025-11-26
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66030 is to upgrade to node-forge version 1.3.2 or later, which contains the fix for the Integer Overflow vulnerability. If upgrading is not immediately feasible, consider implementing input validation to restrict the size of OIDs processed by the asn1.derToOid function. While a direct workaround is difficult without modifying the library, careful review of any ASN.1 parsing logic that uses node-forge is recommended. After upgrading, confirm the fix by attempting to decode a known oversized OID and verifying that it is rejected or handled correctly.