Open Redirect in node-forge

Description

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-8fr3-hfg3-gpgp
• huntr.dev
• CVE-2022-0122
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Improper Verification of Cryptographic Signature in `node-forge` (GHSA-2r2c-g63r-vccr) - CVE-2022-24773
• Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207

Tags:

npm

node-forge