Read the docs
TI-2025-40557 Aliases CVE-2025-66031GHSA-554w-wpv2-vw27

node-forge ASN.1 Unbounded Recursion

Priority MEDIUM 44CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 29 fixed, 17 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00446 38th percentileScored 2026-11-07
Fix Partial forge (digitalbazaar): 1.3.2node-forge (npm): 1.3.2Red Hat: 32 advisoriesRed Hat: 29 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
digitalbazaarforgebefore 1.3.21.3.2Patch availableCNA
—node-forge (npm)before 1.3.21.3.2Patch availableGHSA-554w-wpv2-vw27
  • forge Vendordigitalbazaar Affected before 1.3.2 Fixed in 1.3.2 Patch available CNA
  • node-forge (npm) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-554w-wpv2-vw27

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:*before 1.3.2Vulnerabledigitalbazaar
  • cpe:2.3:a:digitalbazaar:forge:*:*:*:*:*:node.js:*:* Versions before 1.3.2 Vulnerable ·digitalbazaar

Remediation

  • Fix · CNA forge (digitalbazaar) Fixed in 1.3.2
  • Fix · GHSA-554w-wpv2-vw27 node-forge (npm) Fixed in 1.3.2 Advisory →

Red Hat 32 advisories

  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:83619 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
Show 29 more Red Hat advisories
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:5807 Released 2026-03-25 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
  • RHSA-2026:3874 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.4 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3712 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.4
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:3710 Released 2026-03-04 · Red Hat rating Important
    Red Hat OpenShift Pipelines Release 1.15.3
    • Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2737 Released 2026-02-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:2568 Released 2026-02-11 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2350 Released 2026-02-09 · Red Hat rating Important
    RHACS 4.9.3 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1596 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +7
  • RHSA-2026:1517 Released 2026-01-28 · Red Hat rating Important
    RHACS 4.8.8 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:1248 Released 2026-01-26 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:0518 Released 2026-01-13 · Red Hat rating Important
    Red Hat Quay 3.16.1
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0261 Released 2026-01-07 · Red Hat rating Important
    Red Hat Developer Hub 1.7.4 release.
    • Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2025:22941 Released 2025-12-09 · Red Hat rating Important
    Kiali 2.17.2 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2025:22938 Released 2025-12-09 · Red Hat rating Important
    Kiali 2.11.5 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2025:22937 Released 2025-12-09 · Red Hat rating Important
    Kiali 2.4.11 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2025:22936 Released 2025-12-09 · Red Hat rating Important
    Kiali 1.73.25 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
  • RHSA-2025:22861 Released 2025-12-08 · Red Hat rating Important
    Red Hat Developer Hub 1.8.1 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Migration Toolkit for Virtualization 2.9Fixed RHSA-2026:1248
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:1517
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:2350, RHSA-2026:2568
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:1596
Red Hat Ceph Storage 8Fixed RHSA-2026:2737
Red Hat Developer Hub 1.7Fixed RHSA-2026:0261
Red Hat Developer Hub 1.8Fixed RHSA-2025:22861
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.16Fixed RHSA-2026:5807
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712, RHSA-2026:3713
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:3874
Red Hat OpenShift Pipelines 1.15Fixed RHSA-2026:3710
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2025:22936
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2025:22937
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2025:22938
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2025:22941
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:83619
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:40984
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.16Fixed RHSA-2026:0518
Red Hat Quay 3.9Fixed RHSA-2026:2754
Not affected: 46 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Virtualization 2.9
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ceph Storage 8
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.7
  • Red Hat Developer Hub 1.8
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenShift Pipelines 1.15
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Process Automation 7
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of OptaPlanner 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66031
  2. 2026-10-03 Alias added: GHSA-554w-wpv2-vw27
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  6. 2026-10-16 Fix available: Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.17 · Red Hat

References

Patch 1

Advisory 1

Other 1

  • TI-2026-26254 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVSS 3.1CRITICAL 9.1
  • TI-2026-82739 ASN.1 resource exhaustion in Forge asn1.fromDer via BIT STRINGs CVSS 3.1HIGH 7.5
  • TI-2026-82735 Denial of service in Forge TLS record processing via stack exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-26253 Forge has signature forgery in Ed25519 due to missing S > L check CVSS 3.1HIGH 7.5
  • TI-2026-26252 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVSS 3.1HIGH 7.5
  • TI-2026-26249 Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences