Listen to this Post
The vulnerability exists in the library’s ASN.1 object identifier (OID) decoding logic. When parsing a DER-encoded OID, `node-forge` uses a loop to parse variable-length arcs. Each arc is a base-128 encoded integer. The library uses JavaScript’s bitwise OR operator (|) to construct the final arc value from accumulated bytes. However, JavaScript’s bitwise operators treat all numbers as 32-bit signed integers, causing truncation for values exceeding 0x7fffffff. An attacker can craft an OID with an initial arc value larger than 2^31-1. During decoding, the bitwise truncation silently converts this large, potentially untrusted arc into a smaller, trusted value. This corrupted OID is then passed to downstream security checks (e.g., certificate policy validation), which may incorrectly accept it as a known, permitted OID, leading to a security bypass.
DailyCVE Form:
Platform: Node.js Library
Version: <=1.3.1
Vulnerability : OID Parsing Overflow
Severity: Medium
Date: 2025-11-26
Prediction: Patched 2025-11-26
What Undercode Say:
npm list node-forge
// Example of vulnerable parsing logic (simplified)
let arc = 0;
for (let i = 0; i < bytes.length; i++) {
arc = (arc << 7) | (bytes[bash] & 0x7F); // Truncation occurs here for large values
}
How Exploit:
Craft malicious certificate.
Embed oversized OID.
Bypass policy validation.
Protection from this CVE
Update to v1.3.2.
Validate certificates independently.
Implement OID allow-listing.
Impact:
Security decision bypass.
Spoofed certificate acceptance.
No direct code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
