digitalbazaar forge up to 1.3.1 integer overflow

Summaryinfo

A vulnerability, which was classified as problematic, was found in digitalbazaar forge up to 1.3.1. Affected by this issue is some unknown functionality. Executing a manipulation can lead to integer overflow. The identification of this vulnerability is CVE-2025-66030. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in digitalbazaar forge up to 1.3.1. It has been declared as problematic. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect integrity. CVE summarizes:

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-66030 since 11/21/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276968 (Linux Distros Unpatched Vulnerability : CVE-2025-66030), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.3.2 eliminates this vulnerability. Applying the patch 3e0c35ace169cfca529a3e547a7848dc7bf57fdb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (276968). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• digitalbazaar

Name

• forge

Version

• 1.3.0
• 1.3.1

License

• open-source

Website

• Product: https://github.com/digitalbazaar/forge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion