node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Affected versions of this package are vulnerable to Interpretation Conflict via the asn1.validate() function. An attacker can cause schema validation to become desynchronized, resulting in semantic divergence that may allow bypassing cryptographic verifications and security decisions, by passing in ASN.1 data with optional parameters that may be interpreted as object boundaries.