A vulnerability in node-forge versions prior to 1.4.1 causes incomplete validation of PKCS#7 padding during AES and DES decryption in CBC and ECB modes. The decryption function only checked the last padding byte and allowed malformed padding, including zero counts and oversized counts, which could silently remove up to four blocks of plaintext. This flaw was fixed in node-forge 1.4.1 by enforcing strict PKCS#7 padding validation. The vulnerability does not affect confidentiality or availability but could allow attackers to manipulate ciphertext to cause silent plaintext truncation. Applications decrypting untrusted data with CBC or ECB mode should authenticate ciphertext or use authenticated encryption modes like AES-GCM.