Description
Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 – 2**32 - 1. The arithmetic in the numBitLen didn’t take into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop.
Recommendation
Update the @apeleghq/asn1-der package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.4
- Patched version(s): 1.0.4
References
Could your website be exposed too?
SmartScanner can check your website for ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
- markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
- @mozilla/readability Denial of Service through Regex - CVE-2025-2792
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
You might also like:
See something that needs correcting? Let us knowUpdated April 08, 2025