GHSA-5rrq-pxf6-6jx5LowDisclosed before NVD

Prototype Pollution in node-forge debug API.

Published
January 8, 2022
Last Modified
January 11, 2023

📋 Description

Impact

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Patches

The forge.debug API and related functions were removed in 1.0.0.

Workarounds

Don't use the forge.debug API directly or indirectly with untrusted input.

References

  • https://www.huntr.dev/bounties/1-npm-node-forge/

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • npm/node-forge:< 1.0.0

🔗 References (2)