GHSA-RHR8-3PM8-CQ29 Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Summary asn1.fromDer decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the maxDepth recursion limit an incomplete fix of CVE-2025-66031 and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs...