The flaw arises because node-forge does not validate the tagLength option supplied to the AES-GCM decryptor. When an attacker supplies a tagLength derived from untrusted data or leaves it unset, the library treats a zero value and an absent authentication tag as an empty tag. During finish() the empty tags match, letting the decrypt call succeed without authenticating the ciphertext. This bypass allows an attacker to decrypt, forge, or tamper with protected data, compromising confidentiality and integrity. The vulnerability falls under CWE-1284 and CWE-354.

Affected software is the digitalbazaar:forge JavaScript library (node-forge) in all releases prior to version 1.4.1. Any application that depends on an older node‑forge version and performs AES‑GCM decryption with an unvalidated tagLength, or whose configuration may allow a zero‑like value, is susceptible. The issue is resolved in the 1.4.1 release.

The CVSS base score of 5.9 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread public exploitation at this time. Attackers would need to supply crafted ciphertext that uses an undefined or zero-length tagLength, which is plausible in applications that derive the parameter from network or user input. Because the flaw requires manipulation of the encryption parameters, the attack vector is at the application layer rather than remote network exploitation. Nonetheless, an unauthenticated decryption can have serious downstream consequences.