Crafted PKCS#12 files pass node-forge password checks with any password
An attacker who does not know a password can alter a PKCS#12 file and still make node-forge accept it as valid under that password, GitHub’s advisory says. The file’s integrity check collapses to a constant key.
GitHub Advisory Database