CVE-2025-66031.patch

From 260425c6167a38aae038697132483b5517b26451 Mon Sep 17 00:00:00 2001
From: wodzen <wodzen@proton.me>
Date: Sat, 22 Nov 2025 10:35:50 -0800
Subject: [PATCH] Add ASN.1 recursion depth limit

Upstream Patch Reference: https://github.com/digitalbazaar/forge/commit/260425c6167a38aae038697132483b5517b26451.patch
---
 src/ui/node_modules/node-forge/lib/asn1.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/ui/node_modules/node-forge/lib/asn1.js b/src/ui/node_modules/node-forge/lib/asn1.js
index 97d1a8a1..c766f7e6 100644
--- a/src/ui/node_modules/node-forge/lib/asn1.js
+++ b/src/ui/node_modules/node-forge/lib/asn1.js
@@ -178,6 +178,11 @@ asn1.Type = {
   BMPSTRING:       30
 };
 
+/**
+ * Sets the default maximum recursion depth when parsing ASN.1 structures.
+ */
+asn1.maxDepth = 256;
+
 /**
  * Creates a new asn1 object.
  *
@@ -439,6 +444,9 @@ asn1.fromDer = function(bytes, options) {
   if(!('decodeBitStrings' in options)) {
     options.decodeBitStrings = true;
   }
+  if(!('maxDepth' in options)) {
+    options.maxDepth = asn1.maxDepth;
+  }
 
   // wrap in buffer if needed
   if(typeof bytes === 'string') {
@@ -459,6 +467,12 @@ asn1.fromDer = function(bytes, options) {
  * @return the parsed asn1 object.
  */
 function _fromDer(bytes, remaining, depth, options) {
+
+  // check depth limit
+  if(depth >= options.maxDepth) {
+    throw new Error('ASN.1 parsing error: Max depth exceeded.');
+  }
+
   // temporary storage for consumption calculations
   var start;
 
-- 
2.43.0