A Regular Expression Denial of Service (ReDoS) vulnerability exists in node-forge's pem.decode() function prior to version 1.4.1. The vulnerability arises from inefficient regular expressions used to parse PEM-encoded data, causing the Node.js event loop to block for seconds to minutes when processing crafted inputs. This affects any application that parses untrusted PEM text using node-forge, such as services handling uploaded certificates or keys. The issue is fixed in node-forge version 1.4.1.