The node-forge library's asn1.fromDer() function decodes BIT STRING contents as ASN.1 by default but fails to enforce the maxDepth recursion limit properly, allowing crafted DER or PEM inputs with deeply nested BIT STRINGs to cause excessive CPU and memory consumption. This can lead to denial of service by aborting the Node.js process due to heap exhaustion. The issue is fixed in node-forge version 1.4.1 by enforcing the maxDepth limit and decoding only one level of BIT STRING contents.