Prototype Pollution in node-forge debug API.

Description

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-5rrq-pxf6-6jx5
• CWE-1321

Related Issues

• Unknown vulnerability in Coinbase Wallet SDK - Vulnerability
• node-forge is vulnerable to ASN.1 OID Integer Truncation - CVE-2025-66030
• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816

Tags:

npm

node-forge