A vulnerability in node-forge versions prior to 1.4.1 allows an attacker to forge PKCS#12 MACs and decrypt PKCS#12 PBE-encrypted private keys without knowing the password by exploiting a zero or negative iteration count in the key derivation function. This flaw causes the key derivation to produce a constant key independent of the password or salt, enabling an attacker to supply malicious PKCS#12 files that verify successfully under any password. The issue is fixed in node-forge 1.4.1 by rejecting iteration counts less than 1.