Prototype Pollution in node-forge util.setPath API

Description

forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.10.0
• Patched version(s): 0.10.0

References

• GHSA-wxgw-qj99-44c2

Related Issues

• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816
• Command Injection in lodash (GHSA-35jh-r3h4-6jhm) - CVE-2021-23337
• Angular (deprecated package) Cross-site Scripting - CVE-2022-25869

Tags:

npm

node-forge