CVE-2025-66031

What it actually does

This vulnerability is an uncontrolled recursion flaw in node-forge 1.3.1 and earlier when parsing ASN.1 DER data. A remote, unauthenticated attacker can supply a deliberately deep or highly nested ASN.1 structure to code paths that call node-forge DER/ASN.1 parsing routines. Because the parser recurses without an effective depth limit, the JavaScript runtime can exhaust the call stack, throwing stack overflow errors and potentially terminating the request handler, worker process, or service instance. The impact is denial of service rather than data theft or code execution.

Why it matters to the business

Applications, APIs, gateways, identity services, certificate-processing workflows, or other systems that parse untrusted certificates, keys, signatures, PKCS structures, or DER-encoded data with vulnerable node-forge versions may be remotely crashed or degraded. This can cause service outages, failed authentication or enrollment flows, increased error rates, autoscaling churn, and operational disruption. The vulnerability is not currently in the CISA KEV catalog, is not known to be used in ransomware campaigns, and has a low EPSS score, but the CVSS severity is high for availability and the issue has been public for 257 days, so exposed parsing endpoints should still be remediated promptly.

How an attack unfolds

An attacker first identifies an application feature that accepts ASN.1 DER or DER-derived inputs, such as uploaded certificates, signed objects, cryptographic messages, keys, S/MIME or PKCS data, or protocol fields later processed by node-forge. The attacker crafts a DER payload containing deeply nested ASN.1 elements. When the application passes that untrusted input into vulnerable node-forge parsing logic, the parser recursively descends through the nested structure until the JavaScript call stack is exhausted. The resulting RangeError or stack overflow can crash the active request, terminate a Node.js worker, restart a container, or make the service repeatedly unavailable if the attacker sends the payload at scale.

How to fix it

Upgrade node-forge to a fixed version that includes the recursion-depth protection for ASN.1 DER parsing. For source deployments tracking digitalbazaar/forge, update to commit 235ad3e70e4fdfdca4fdeb662dfba6588e2c38bd or a later release containing that fix. For Chainguard or Wolfi overmind packages, upgrade to 2.5.1-r4 or later. Rebuild and redeploy all applications and container images that vendor or transitively include node-forge 1.3.1 or below. If immediate patching is not possible, reduce exposure by rejecting untrusted DER/ASN.1 inputs where they are not required, enforcing strict request body size and parsing time limits, isolating parsing in disposable worker processes, rate-limiting unauthenticated upload or certificate-submission endpoints, and adding application-level maximum ASN.1 nesting-depth validation before invoking node-forge.

How to confirm the fix worked

Confirm package inventories, lockfiles, SBOMs, and container image scans no longer show node-forge or forge versions 1.3.1 or earlier. For Chainguard and Wolfi overmind packages, verify installed package version 2.5.1-r4 or later. For Git-sourced digitalbazaar/forge builds, verify the deployed revision includes commit 235ad3e70e4fdfdca4fdeb662dfba6588e2c38bd or later. Rebuild from clean dependency caches and redeploy to ensure stale vulnerable modules are not still packaged. Functionally test DER/ASN.1 parsing with valid certificates and with a safely generated deeply nested DER test case in a non-production environment; the patched implementation should reject the input or fail gracefully without process termination, stack exhaustion, or prolonged resource consumption. Monitor post-deployment error rates, process restarts, and health checks for regression.

Typical attack path

1. Identify internet-facing or remotely reachable functionality that accepts certificates, keys, signatures, PKCS objects, DER blobs, or other ASN.1-encoded input.
2. Confirm or infer that the target application uses node-forge 1.3.1 or earlier, or a downstream package/container image that bundles the vulnerable parser.
3. Generate a malformed but syntactically plausible DER payload with excessive ASN.1 nesting depth.
4. Submit the crafted payload to the vulnerable endpoint or workflow without authentication if the input surface is public.
5. Trigger recursive ASN.1 parsing in node-forge until the JavaScript runtime exhausts the call stack.
6. Repeat requests to cause sustained worker crashes, elevated 5xx responses, request timeouts, container restarts, or service unavailability.

How to detect it

To determine whether exploitation has already occurred, review application logs, Node.js process logs, container runtime events, process supervisor logs, APM traces, reverse proxy logs, WAF/API-gateway logs, and orchestrator events for crashes or repeated failures during certificate, key, signature, PKCS, or DER parsing. Look for RangeError stack overflow messages, repeated references to node-forge ASN.1 parsing functions, abrupt worker exits, container restarts, health-check failures, and bursts of HTTP 500/502/503/504 responses following requests with binary upload bodies or certificate-like payloads. Correlate suspicious events by source IP, user agent, endpoint path, request size, content type, and timing. Since the issue causes denial of service and not persistent compromise, durable host artifacts are unlikely; the strongest evidence is a temporal pattern of malformed ASN.1 input followed by JavaScript stack exhaustion or service restarts. If request body capture is available, inspect suspicious payloads for DER/ASN.1 tag sequences with unusually deep nesting. Also check package telemetry and crash reporting systems for errors originating from forge.asn1.fromDer or related node-forge ASN.1 decoding routines.

• RangeError: Maximum call stack size exceeded
• Maximum call stack size exceeded
• RangeError: Call stack size exceeded
• stack overflow
• forge.asn1.fromDer
• asn1.fromDer
• node-forge/lib/asn1.js
• node_modules/node-forge/lib/asn1.js
• Too much recursion
• Worker exited unexpectedly
• process exited with code 1
• CrashLoopBackOff
• OOMKilled
• HTTP 500
• HTTP 502
• HTTP 503
• HTTP 504

What your security team should do

• Prioritize remediation for internet-facing services, public APIs, identity/certificate enrollment flows, upload handlers, and any unauthenticated feature that parses certificates, keys, signatures, PKCS data, or DER-encoded content.
• Search dependency manifests, lockfiles, SBOMs, and container images for node-forge or forge versions 1.3.1 and below, including transitive dependencies bundled by downstream applications.
• Upgrade affected Chainguard and Wolfi overmind packages to 2.5.1-r4 or later and update Git-sourced digitalbazaar/forge to commit 235ad3e70e4fdfdca4fdeb662dfba6588e2c38bd or later.
• Add compensating controls while patching: request size limits, rate limits, unauthenticated endpoint throttling, parser isolation, process supervision, and WAF/API-gateway rules for anomalous certificate or DER upload abuse.
• Review historical logs for stack overflow errors, ASN.1 parsing exceptions, sudden 5xx spikes, worker crashes, and container restarts correlated with requests carrying certificate, key, or DER-like payloads.
• Because public exploitation maturity is currently listed as none and EPSS is low, use exposure-based prioritization rather than emergency ransomware response, but do not defer remediation for remotely reachable parsers.