From fc1f3403fc436693ab99097c8c6b3eee15a2a8a1 Mon Sep 17 00:00:00 2001 From: "David I. Lehn" Date: Tue, 25 Nov 2025 21:38:30 -0500 Subject: [PATCH] Update CVE details. --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f91e618e..765bafdfa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ Forge ChangeLog divergence that may bypass downstream cryptographic verifications and security decisions. - Reported by Hunter Wodzenski. - - CVE ID: [CVE-2025-12816](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12816) + - CVE ID: [CVE-2025-12816](https://www.cve.org/CVERecord?id=CVE-2025-12816) - GHSA ID: [GHSA-5gfm-wpxj-wjgq](https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq) - **HIGH**: ASN.1 Unbounded Recursion - An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions @@ -20,6 +20,7 @@ Forge ChangeLog Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. - Reported by Hunter Wodzenski. + - CVE ID: [CVE-2025-66031](https://www.cve.org/CVERecord?id=CVE-2025-66031) - GHSA ID: [GHSA-554w-wpv2-vw27](https://github.com/digitalbazaar/forge/security/advisories/GHSA-554w-wpv2-vw27) - **MODERATE**: ASN.1 OID Integer Truncation - An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 @@ -28,6 +29,7 @@ Forge ChangeLog as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. - Reported by Hunter Wodzenski. + - CVE ID: [CVE-2025-66030](https://www.cve.org/CVERecord?id=CVE-2025-66030) - GHSA ID: [GHSA-65ch-62r8-g69g](https://github.com/digitalbazaar/forge/security/advisories/GHSA-65ch-62r8-g69g) ### Fixed