CVE-2025-66031
Fixed in a distro release EPSS <1%CVSS 8.7
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Products: digitalbazaar forge
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | node-forge | 1.3.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.4-r10 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r4 |
| Chainguard | argo-workflow-cli-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflow-cli-3.7 | 3.7.4-r2 |
| Chainguard | argo-workflow-controller-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.6-compat | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.7 | 3.7.4-r2 |
| Chainguard | argo-workflow-controller-3.7-compat | 3.7.4-r2 |
| Chainguard | argo-workflow-executor-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.6-compat | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.7 | 3.7.4-r2 |
| Chainguard | argo-workflow-executor-3.7-compat | 3.7.4-r2 |
| Chainguard | argo-workflows-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflows-3.7 | 3.7.4-r2 |
| Chainguard | argo-workflows-known-hosts-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflows-known-hosts-3.7 | 3.7.4-r2 |
| Chainguard | argo-workflows-ui-3.6 | 3.6.13-r2 |
| Chainguard | argo-workflows-ui-3.7 | 3.7.4-r2 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r25 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.5-r1 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r87 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.7-r1 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r6 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.3-r2 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r5 |
| Chainguard | jitsucom-jitsu | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r8 |
| Chainguard | jitsucom-jitsu-rotor | 2.11.0-r8 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | 7.17.29-r7 |
| Chainguard | kibana-8.17 | 8.17.10-r4 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r4 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r4 |
| Chainguard | kibana-8.18 | 8.18.8-r3 |
| Chainguard | kibana-8.18-bitnami | 8.18.8-r3 |
| Chainguard | kibana-8.18-iamguarded | 8.18.8-r3 |
| Chainguard | kibana-8.19 | 8.19.7-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.7-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.7-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r3 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r3 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r3 |
| Chainguard | kibana-9.1 | 9.1.7-r2 |
| Chainguard | kibana-9.1-iamguarded | 9.1.7-r2 |
| Chainguard | kibana-9.2 | 9.2.1-r2 |
| Chainguard | kibana-9.2-iamguarded | 9.2.1-r2 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r6 |
| Chainguard | kubeflow-pipelines | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-apiserver | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-cache_server | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-frontend | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.15.0-r0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.15.0-r0 |
| Chainguard | opensearch-dashboards-2 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-config | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-3 | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-config | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-config | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.2.0-r2 |
| Debian 11 | node-node-forge | no fix |
| Ubuntu 20.04 LTS | node-node-forge | no fix |
| Ubuntu 22.04 LTS | node-node-forge | no fix |
| Wolfi | argo-workflow-cli-3.7 | 3.7.4-r2 |
| Wolfi | argo-workflow-controller-3.7 | 3.7.4-r2 |
| Wolfi | argo-workflow-controller-3.7-compat | 3.7.4-r2 |
| Wolfi | argo-workflow-executor-3.7 | 3.7.4-r2 |
| Wolfi | argo-workflow-executor-3.7-compat | 3.7.4-r2 |
| Wolfi | argo-workflows-3.7 | 3.7.4-r2 |
| Wolfi | argo-workflows-known-hosts-3.7 | 3.7.4-r2 |
| Wolfi | argo-workflows-ui-3.7 | 3.7.4-r2 |
| Wolfi | jitsucom-jitsu | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r8 |
| Wolfi | jitsucom-jitsu-rotor | 2.11.0-r8 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r6 |
| Wolfi | kubeflow-pipelines | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-apiserver | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-cache_server | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-frontend | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.15.0-r0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.15.0-r0 |
| Wolfi | opensearch-dashboards-3 | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-config | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.2.0-r2 |