Node-Forge (< 1.4.1)

Prior to version 1.4.1, node-forge incorrectly parses deprecated certificate extensions, potentially allowing a certificate to be accepted as a CA and enabling impersonation.

Digital Bazaar node-forge versions prior to 1.4.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the pem.decode() function, allowing unauthenticated attackers to cause high CPU usage via malformed PEM input.