Michael-Jread

Forge (also known as node-forge) is a native JavaScript implementation of Transport Layer Security. The `asn1.fromDer()` function fails to consistently apply the `maxDepth` limit when decoding ASN.1 data stored within BIT STRING values, recursively retaining copies at each nesting level. An attacker can provide a specially crafted DER (Distinguished Encoding Rules) containing nested BIT STRINGs to trigger excessive recursion, high CPU utilization, and quadratic memory consumption.

The asynchronous Smile parser `NonBlockingByteArrayParser` allocates a byte array based on a raw-binary length prefix from untrusted input without an upper bound or overflow check. Specifically, when encountering the raw-binary marker 0xFD, the ` decodeVInt()` function calculates the length without the overflow guard used in the blocking `SmileParser. readUnsignedVInt` function. Subsequently, ` startRawBinary` allocates the specified length immediately. This can allow a small input to trigger a massive memory allocation, leading to an `OutOfMemoryError` on reactive or asynchronous Smile endpoints. Additionally, a crafted VInt (Variable Integer) that overflows an integer can result in a negative length, causing a `NegativeArraySizeException`. Both scenarios can crash the request or processing thread.

An incorrect authorization issue exists in the ACL policy cache. This allows tokens to reference policies from arbitrary namespaces through the use of specially crafted policy names. Consequently, attackers possessing these tokens can acquire the capabilities of cached policies in other namespaces, including the root namespace, enabling them to operate across namespace boundaries.

A use-after-free issue exists in the drdynvc channel. This occurs when a pool-owned stream is freed using the owned-stream deallocator because the `totalLength` is smaller than the chunk size. A malicious RDP server can trigger this by sending a single well-formed Virtual Channel PDU, leading to a client crash during teardown.

An unbounded per-connection queue growth flaw exists in the `HttpServerCodec`. The codec tracks the HTTP method of unanswered pipelined requests; while the first 32 entries are bit-packed into a single long, subsequent entries are added to the `methodOverflowQueue` (an `ArrayDeque` with no size limit or rejection path). A remote, unauthenticated attacker can exploit this by pipelining HTTP/1.1 requests on a single connection and withholding reads to prevent responses from being flushed. This action allows the queue to grow without bound, leading to unbounded heap growth and a denial of service.

A ByteBuf leak exists in the `StompSubframeDecoder` function. When a frame's declared content-length is fully read, the decoder allocates a chunk buffer and waits for the terminating NUL byte. If this byte is not received, the buffer is not released because the signal thrown by `skipNullCharacter()` extends Error instead of Exception, bypassing the release path. Additionally, the decoder does not override `handlerRemoved0` or `channelInactive`, allowing the buffer to persist after channel teardown. A remote peer can trigger this leak by sending a well-formed frame body without the terminating NUL byte, potentially leading to memory exhaustion as the pooled allocator does not reclaim the memory.

Improper validation of the final transfer coding in the `Transfer-Encoding` header allows attackers to perform request smuggling using malformed encoding declarations. This occurs when attackers split the `Transfer-Encoding` header across multiple lines or use values such as `chunked, xchunked` to bypass validation. Consequently, messages may be decoded as chunked even when the final coding is not chunked.