CVE-2026-119191 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer, BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING...