node-forge is vulnerable to ASN.1 OID Integer Truncation

An attacker can exploit this vulnerability by crafting malicious ASN.1 structures containing oversized OIDs. The asn1.derToOid function in node-forge performs a bitwise truncation, causing oversized OIDs to be decoded as smaller, trusted OIDs. This can lead to a bypass of security mechanisms that rely on OID validation, potentially allowing an attacker to impersonate legitimate entities or gain unauthorized access. The impact is particularly severe in applications that use node-forge for cryptographic operations or secure communication, as it could compromise the integrity of the entire system. The truncation effectively allows an attacker to masquerade as a trusted entity by crafting an OID that, after truncation, matches a legitimate, trusted OID.

Applications and services that rely on the node-forge library for ASN.1 parsing, particularly those involved in cryptographic operations or secure communication, are at risk. This includes systems that process certificates, digital signatures, or other data formats that utilize ASN.1 encoding. Projects using older versions of node-forge in their build pipelines are also vulnerable.

• nodejs / supply-chain:

  npm list node-forge

• nodejs / supply-chain:

  npm audit node-forge

• nodejs / supply-chain: Check package.json for versions <= 1.3.1 • generic web: Inspect application logs for ASN.1 parsing errors or unexpected OID values.

1. 2025-11-26Disclosure

   disclosure

1. आरक्षित2025-11-21
2. प्रकाशित2025-11-26
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-66030 is to upgrade to node-forge version 1.3.2 or later, which contains the fix for the Integer Overflow vulnerability. If upgrading is not immediately feasible, consider implementing input validation to restrict the size of OIDs processed by the asn1.derToOid function. While a direct workaround is difficult without modifying the library, careful review of any ASN.1 parsing logic that uses node-forge is recommended. After upgrading, confirm the fix by attempting to decode a known oversized OID and verifying that it is rejected or handled correctly.

अंतिम अपडेट

1.4.02 महीने पहले