# What changed in asn1js

> 17 changes in asn1js 3 to 4 from its official release notes, upgrade guides and advisories: 10 breaking, 1 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/asn1js/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## asn1js 4

### Breaking changes

- Libraries that check instanceof against asn1js classes must use the same asn1js major version as the application. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- Decoding an odd-length BMPString or a UniversalString whose length is not a multiple of 4 returns a decode error instead of throwing. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- The new exports map blocks deep imports into build/. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- The package ships a single ES module; CommonJS code can still use require("asn1js") on supported Node.js versions through require(esm). (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- Constructing an Integer with a non-integer number now throws RangeError instead of truncating the value. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- TypeScript projects that compile to CommonJS need to use node20 or nodenext. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- The minimum supported versions are ^20.19.0 or >=22.12.0; older Node.js versions are no longer supported. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- Characters outside the BMP are encoded as single UCS-4 code points instead of surrogate pairs. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- Encoding a year outside 1950–2049 now throws RangeError, including when constructed with valueDate; use GeneralizedTime instead. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)
- Setting valueDec to a non-integer number now throws RangeError instead of truncating the value. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)

### Behavior and default changes

- Values from 2^49 to 2^53 can now be encoded for OID arcs and tag numbers. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)

### Fixes and other changes

- Negative BigInt values are now encoded correctly. (4.0.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v4.0.0)

## asn1js 3

### Security

- Added parser limits to prevent unbounded BER parsing. (3.0.10) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v3.0.10)

### Performance

- Parsing and BER encoding reduce allocations. (3.1.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v3.1.0)
- Optimized parsing to avoid quadratic buffer growth. (3.0.10) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v3.0.10)

### Fixes and other changes

- DER fractional seconds omit trailing zeros. (3.1.0) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v3.1.0)
- Fixes BER encoding of an empty bitstring so the output is 0x030100. (3.0.7) — [release notes](https://github.com/PeculiarVentures/ASN1.js/releases/tag/v3.0.7)