# What changed in node-forge

> 10 changes in node-forge 1 from its official release notes, upgrade guides and advisories: 6 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/node-forge/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## node-forge 1

### Security

- Checks that the signature scalar S is less than L, rejecting forged non-canonical signatures. (1.4.0) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#140---2026-03-24)
- Checks for absent basicConstraints on non-leaf certificates, preventing certificates without the required extensions from acting as CAs. (1.4.0) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#140---2026-03-24)
- Rejects malformed DigestInfo sequences and signatures that do not have the required eight octets of padding, addressing signature forgery. (1.4.0) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#140---2026-03-24)
- Adds a global configurable maximum ASN.1 parsing depth of 256 to prevent unbounded recursive parsing. (1.3.2) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#132---2025-11-25)
- Fixes a PKCS#12 MAC verification bypass caused by missing macData enforcement and improper ASN.1 validation. (1.3.2) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#132---2025-11-25)
- Rejects parsed OID values larger than 2**32 - 1 and DER OID values larger than 2**53 - 1, preventing oversized arcs from truncating to smaller OIDs. (1.3.2) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#132---2025-11-25)

### New APIs and options

- Adds the requested pseudonym OID. (1.4.0) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#140---2026-03-24)
- Adds a per-call maxDepth option to limit DER parsing recursion depth. (1.3.2) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#132---2025-11-25)

### Fixes and other changes

- Avoids an infinite loop and returns zero early when the target object value is <= 0. (1.4.0) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#140---2026-03-24)
- Makes digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2. (1.3.3) — [release notes](https://github.com/digitalbazaar/forge/blob/07d4e162762ed4fdab5caca9ebf78237fcf85339/CHANGELOG.md#133---2025-12-02)