Prototype Pollution In node-forge
Description
Prototype Pollution in node-forge util.setPath API
Impact
forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.
Patches
The forge.util.setPath API and related functions were removed in 0.10.0.
Workarounds
Don't call forge.util.setPath directly or indirectly with untrusted keys.
References
For more information
If you have any questions or comments about this advisory:
Open an issue in forge.
Email us at [email protected].
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 0.10.0 |
Aliases
1. 2.
References
1.