unstale

npm / node-forge

node-forge

What changed in node-forge 1, from its official release notes, upgrade guides and advisories. Also covers @types/node-forge. Sources checked 2026-10-18.

6 security2 new APIs and options2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

node-forge 110 changes

Security 6

  • Checks that the signature scalar S is less than L, rejecting forged non-canonical signatures.

    1.4.0release notes

  • Checks for absent basicConstraints on non-leaf certificates, preventing certificates without the required extensions from acting as CAs.

    1.4.0release notes

  • Rejects malformed DigestInfo sequences and signatures that do not have the required eight octets of padding, addressing signature forgery.

    1.4.0release notes

  • Adds a global configurable maximum ASN.1 parsing depth of 256 to prevent unbounded recursive parsing.

    1.3.2release notes

  • Fixes a PKCS#12 MAC verification bypass caused by missing macData enforcement and improper ASN.1 validation.

    1.3.2release notes

  • Rejects parsed OID values larger than 2**32 - 1 and DER OID values larger than 2**53 - 1, preventing oversized arcs from truncating to smaller OIDs.

    1.3.2release notes

New APIs and options 2

  • Adds the requested pseudonym OID.

    1.4.0release notes

  • Adds a per-call maxDepth option to limit DER parsing recursion depth.

    1.3.2release notes

Fixes and other changes 2

  • Avoids an infinite loop and returns zero early when the target object value is <= 0.

    1.4.0release notes

  • Makes digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

    1.3.3release notes