CVE-2025-66031

🗓️ 26 Nov 2025 22:23:26Reported by Debian Security Bug TrackerType

Uncontrolled recursion in node-forge 1.3.1 enables remote denial of service from deep parsing; fixed in 1.3.2.

Reporter	Title	Published	Views	Family All 86
ibm	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	30 Jan 202609:11	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses node-forge which is vulnerable to CVE-2025-66030, CVE-2025-66031	30 Jan 202608:28	–	ibm
ibm	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	26 Feb 202603:04	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	27 Feb 202615:16	–	ibm
ibm	Security Bulletin: Security Vulnerabilities in node.js packages affect IBM Voice Gateway	2 Dec 202516:28	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to denial of service and loss of integrity [CVE-2025-12816, CVE-2025-66030, CVE-2025-66031]	19 Dec 202515:32	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	11 Mar 202617:12	–	ibm
ibm	Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source packages.	20 Mar 202616:42	–	ibm
ibm	Security Bulletin: node-forge-1.3.1.tgz, IBM Sterling Connect:Direct Web Services is affected by bypass downstream cryptographic verifications and security decisions.	2 Jun 202612:01	–	ibm
cbl_mariner	CVE-2025-66031 affecting package reaper for versions less than 3.1.1-21	5 Dec 202503:44	–	cbl_mariner

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	node-node-forge	0.10.0~dfsg-3+deb11u1	node-node-forge_0.10.0~dfsg-3+deb11u1_any.deb

26 Nov 2025 22:23Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

CVSS 48.7

EPSS0.00381

SSVC