Open Redirect in node-forge

Description

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-8fr3-hfg3-gpgp
• huntr.dev
• CVE-2022-0122
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816
• Prototype pollution in 101 - CVE-2021-25943
• Prototype Pollution in node-forge - CVE-2020-7720

Tags:

npm

node-forge