Open Redirect in node-forge

Description

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-8fr3-hfg3-gpgp
• huntr.dev
• CVE-2022-0122
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• Improper Verification of Cryptographic Signature in node-forge - node-forge - CVE-2022-24771
• Improper Verification of Cryptographic Signature in `node-forge` - node-forge - GHSA-2r2c-g63r-vccr - CVE-2022-24773
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-forge