Prototype Pollution in node-forge util.setPath API

Description

forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.10.0
• Patched version(s): 0.10.0

References

• GHSA-wxgw-qj99-44c2

Related Issues

• Prototype Pollution in node-forge debug API. - Vulnerability
• Prototype Pollution in node-forge - CVE-2020-7720
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• URL parsing in node-forge could lead to undesired behavior. - Vulnerability

Tags:

npm

node-forge