-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-forge | npm | < 1.3.2 | 1.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is an uncontrolled recursion in the ASN.1 parser of the node-forge library. The analysis of the provided patch commit 260425c6167a38aae038697132483b5517b26451 clearly indicates the vulnerable functions. The patch introduces a recursion depth limit to mitigate the vulnerability. The main entry point for the vulnerable operation is asn1.fromDer, which in turn calls the recursive function _fromDer. The patch adds a depth check within _fromDer and sets a default maxDepth in asn1.fromDer. Therefore, both functions are directly involved in the vulnerability. An attacker can exploit this by sending a deeply nested ASN.1 structure to any application using asn1.fromDer for parsing, causing the _fromDer function to recurse until the call stack is exhausted, resulting in a denial of service.
asn1.fromDerlib/asn1.js
_fromDerlib/asn1.js
Ongoing coverage of React2Shell