URL parsing in node-forge could lead to undesired behavior.

Description

The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-gf8q-jrpm-jvxq
• www.huntr.dev
• CWE-601
• OWASP 2021-A1

Related Issues

• Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
• Prototype Pollution in node-forge - CVE-2020-7720
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771

Tags:

npm

node-forge