CVE-2025-66030

A flaw was found in node-forge. This vulnerability allows bypass of downstream Object Identifier (OID)-based security decisions via crafting Abstract Syntax Notation One (ASN.1) structures containing Object Identifiers (OIDs) with oversized arcs, which are then decoded as smaller, trusted OIDs due to 32-bit bitwise truncation.

This vulnerability is rated Moderate for Red Hat products. An integer overflow in the node-forge library allows for the bypass of Object Identifier (OID)-based security decisions. Attackers could craft Abstract Syntax Notation One (ASN.1) structures with oversized arcs, leading to their misinterpretation as trusted OIDs due to 32-bit bitwise truncation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.