npm / asn1js
asn1js
What changed in asn1js 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
10 breaking1 security2 performance1 behavior and defaults3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initasn1js 412 changes
Breaking changes 10
Libraries that check instanceof against asn1js classes must use the same asn1js major version as the application.
Decoding an odd-length BMPString or a UniversalString whose length is not a multiple of 4 returns a decode error instead of throwing.
The new exports map blocks deep imports into build/.
The package ships a single ES module; CommonJS code can still use require("asn1js") on supported Node.js versions through require(esm).
Constructing an Integer with a non-integer number now throws RangeError instead of truncating the value.
TypeScript projects that compile to CommonJS need to use node20 or nodenext.
The minimum supported versions are ^20.19.0 or >=22.12.0; older Node.js versions are no longer supported.
Characters outside the BMP are encoded as single UCS-4 code points instead of surrogate pairs.
Encoding a year outside 1950–2049 now throws RangeError, including when constructed with valueDate; use GeneralizedTime instead.
Setting valueDec to a non-integer number now throws RangeError instead of truncating the value.
Behavior and default changes 1
Values from 2^49 to 2^53 can now be encoded for OID arcs and tag numbers.
Fixes and other changes 1
Negative BigInt values are now encoded correctly.
asn1js 35 changes
Security 1
Added parser limits to prevent unbounded BER parsing.
Performance 2
Parsing and BER encoding reduce allocations.
Optimized parsing to avoid quadratic buffer growth.
Fixes and other changes 2
DER fractional seconds omit trailing zeros.
Fixes BER encoding of an empty bitstring so the output is 0x030100.