Forge Unbounded Recursion Vulnerability

Forge is a native JavaScript implementation of Transport Layer Security. It's used by Node.js to establish secure connections. This vulnerability allows attackers to craft malicious ASN.1 structures that trigger uncontrolled recursion in the parser, leading to a Denial-of-Service (DoS) via stack exhaustion.

Affected versions: 1.3.1

Upgrade to node-forge version 1.3.2 or later.
Maven: Update your pom.xml dependency version
If you can't upgrade immediately:
- Set forge.asn1.fromDer to false as a Node.js flag
- Remove the asn1.fromDer function from your codebase.

• Patch
• Vendor Advisory