Prototype Pollution in node-forge debug API.

LOWGHSA-5rrq-pxf6-6jx5 · Published 08/01/2022 · updated 07/01/2022

In short

GHSA-5rrq-pxf6-6jx5 is a LOW vulnerability affecting node-forge.
Fix: update to 1.0.0 or later.

Package	Affected versions	Patched versions
node-forge npm	`< 1.0.0`	`1.0.0`

Description

Impact

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Patches

The forge.debug API and related functions were removed in 1.0.0.

Workarounds

Don't use the forge.debug API directly or indirectly with untrusted input.

References

https://www.huntr.dev/bounties/1-npm-node-forge/

For more information

If you have any questions or comments about this advisory:

Open an issue in forge.
Email us at [email protected].

References

digitalbazaar/forge security advisory · WEB
digitalbazaar/forge · PACKAGE

More vulnerabilities in node-forge

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free