Prototype Pollution in node-forge util.setPath API

Description

forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.10.0
• Patched version(s): 0.10.0

References

• GHSA-wxgw-qj99-44c2

Related Issues

• Prototype Pollution in node-forge debug API. - Vulnerability
• Prototype Pollution in node-forge - CVE-2020-7720
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548

Tags:

npm

node-forge