Skip to content
Fencer Vulns
high 7.5

CVE-2025-66031 json

node-forge ASN.1 Unbounded Recursion

published 2025-11-26 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-199767 , GHSA-554w-wpv2-vw27

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Patch / fix

  • npm node-forge 1.3.2
  • digitalbazaar forge 1.3.2
  • reaper CBL-Mariner 2.0 3.1.1-21

azure linux advisories AZL-71134

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-66031 updated cvss 5.3

node-forge: node-forge ASN.1 Unbounded Recursion

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/elasticsearch6-rhel9, openshift-logging/logging-curator5-rhel9, openshift-logging/elasticsearch-proxy-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/elasticsearch-rhel9-operator, +1 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-hub-db-migration-rhel8, +1 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-collector-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8 Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-ui-ocp-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 io.apicurio-apicurito, io.syndesis-syndesis-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9, openshift4/nmstate-console-plugin-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
show 26 more
  • Red Hat OpenShift Dev Spaces devspaces-tech-preview/idea-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/argo-rollouts-rhel8, +3 more Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Virtualization 2.9 migration-toolkit-virtualization 1769034026
    fixed: vendor fix RHSA-2026:1248
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1771227610, network-observability 1771227650
    fixed: vendor fix RHSA-2026:2900
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1769615659
    fixed: vendor fix RHSA-2026:1517
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1770074713, advanced-cluster-security 1770250889
    fixed: vendor fix RHSA-2026:2350
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1768889838
    fixed: vendor fix RHSA-2026:1596
  • Red Hat Ceph Storage 8 rhceph 1770630607
    fixed: vendor fix RHSA-2026:2737
  • Red Hat Developer Hub 1.7 rhdh 1.7.4-1767715042
    fixed: vendor fix RHSA-2026:0261
  • Red Hat Developer Hub 1.8 rhdh 1.8.1-1764857949
    fixed: vendor fix RHSA-2025:22861
  • Red Hat Discovery 2 discovery 1767904573
    fixed: vendor fix RHSA-2026:0414
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat OpenShift AI 2.16 rhoai 1774282136
    fixed: vendor fix RHSA-2026:5807
  • Red Hat OpenShift AI 3.3 rhoai 1769162595, rhoai 1771502843, rhoai 1771502844, rhoai 1771502845, rhoai 1771502863, rhoai 1771502869, +14 more
    fixed: vendor fix RHSA-2026:19712
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-networking-console-plugin-rhel9 1779256322
    fixed: vendor fix RHSA-2026:20041
  • Red Hat Openshift Data Foundation 4.16 odf4/cephcsi-rhel9 1791969746, odf4/odf-cli-rhel9 1791966130, odf4/mcg-core-rhel9 1791967127, odf4/odf-console-rhel9 1791966989, odf4/mcg-rhel9-operator 1791970996, odf4/ocs-rhel9-operator 1791968560, +12 more
    fixed: vendor fix RHSA-2026:83619
  • Red Hat Openshift Data Foundation 4.17 odf4/cephcsi-rhel9 1791966003, odf4/odf-cli-rhel9 1791888742, odf4/mcg-core-rhel9 1791889616, odf4/odf-console-rhel9 1791887928, odf4/mcg-rhel9-operator 1791889753, odf4/ocs-rhel9-operator 1791960285, +13 more
    fixed: vendor fix RHSA-2026:83622
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 devspaces 1769804221
    fixed: vendor fix RHSA-2026:2456
  • Red Hat OpenShift GitOps 1.18 openshift-gitops-1 1772438822
    fixed: vendor fix RHSA-2026:3874
  • Red Hat OpenShift Pipelines 1.15 openshift-pipelines 1772036471
    fixed: vendor fix RHSA-2026:3710
  • Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh 1.73.25-1764836020, openshift-service-mesh 1.73.25-1764836138
    fixed: vendor fix RHSA-2025:22936
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 2.4.11-1764836335, openshift-service-mesh 2.4.11-1764844423
    fixed: vendor fix RHSA-2025:22937

6 more fixed, 46 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 7.5

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm node-forge
<1.3.2
1.3.2

Affected products

  • digitalbazaar forge

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.