REDHAT-BUG-2417397: Medium severity npm/node-forge vulnerability

Q: Who is exposed to this issue?

Applications using node-forge 1.3.1 or earlier are exposed when they parse untrusted DER input. The affected component is the ASN.1 parser.

Q: What does an attacker need to exploit the flaw?

An attacker only needs to send a crafted, deeply nested ASN.1 structure in DER input to a vulnerable parser. No authentication is required.

Q: What is the impact of successful exploitation?

Processing the crafted DER input can cause unbounded recursive parsing and exhaust the stack, resulting in a denial of service.

Q: What should be done if the application uses an affected version?

Upgrade node-forge to version 1.3.2, which contains the patch. Until upgrading, avoid parsing DER inputs from untrusted sources where possible.

Published Nov 26, 2025

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.

Affected Software

1 affected component

npm/node-forge<=1.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade node-forge to a version that resolves this vulnerability.
Fixed in 1.3.2

Event History

Nov 26, 2025

Data Sourced

via Red Hat·11:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using node-forge 1.3.1 or earlier are exposed when they parse untrusted DER input. The affected component is the ASN.1 parser.

What does an attacker need to exploit the flaw?

An attacker only needs to send a crafted, deeply nested ASN.1 structure in DER input to a vulnerable parser. No authentication is required.

What is the impact of successful exploitation?

Processing the crafted DER input can cause unbounded recursive parsing and exhaust the stack, resulting in a denial of service.

What should be done if the application uses an affected version?

Upgrade node-forge to version 1.3.2, which contains the patch. Until upgrading, avoid parsing DER inputs from untrusted sources where possible.

REDHAT-BUG-2417397: Medium severity npm/node-forge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What should be done if the application uses an affected version?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

What is the impact of successful exploitation?

What should be done if the application uses an affected version?