What is GHSA-gf8q-jrpm-jvxq?

GHSA-gf8q-jrpm-jvxq is a security advisory published by GitHub Security Advisories with Low severity. URL parsing in node-forge could lead to undesired behavior.

Why does GHSA-gf8q-jrpm-jvxq have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-gf8q-jrpm-jvxq?

GHSA-gf8q-jrpm-jvxq affects 1 product, including: npm/node-forge:\u003c 1.0.0.

GHSA-gf8q-jrpm-jvxqLowDisclosed before NVD

URL parsing in node-forge could lead to undesired behavior.

Vendor

GitHub Security Advisories

Published

January 8, 2022

Last Modified

January 11, 2023

📋 Description

Impact

The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

Patches

forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.

Workarounds

Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.

References

https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

For more information

If you have any questions or comments about this advisory:

Open an issue in forge
Email us at [email protected]

🎯 Affected products1

npm/node-forge:< 1.0.0

🔗 References (4)

https://github.com/digitalbazaar/forge/security/advisories/GHSA-gf8q-jrpm-jvxq
https://nvd.nist.gov/vuln/detail/CVE-2022-0122
https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae
https://github.com/advisories/GHSA-gf8q-jrpm-jvxq