CRITICAL9.8

GHSA-92xj-mqp7-vmcj

Prototype Pollution in node-forge

Quick fix

GHSA-92xj-mqp7-vmcj — node-forge: upgrade to the fixed version with the command below.

npm install node-forge@0.10.0

Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/node-forge

Introduced in: 0Fixed in: 0.10.0

Fixnpm install node-forge@0.10.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7720[ADVISORY]
https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756[WEB]
https://github.com/digitalbazaar/forge[PACKAGE]
https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md[WEB]
https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed[WEB]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293[WEB]
https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677[WEB]