GitHub Advisoryadvisory · npm

GHSA-5rrq-pxf6-6jx5 Prototype Pollution in node-forge debug API.

LOW Published 2022-01-08 Modified 2022-01-07 Official page ↗
Ecosystem
npm
Packages
node-forge
Severity
Low
Weaknesses
CWE-1321
Reviewed
2022-01-07

Affected packages

• npm node-forge: < 1.0.0 → fixed in 1.0.0

Description

Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way. Patches The `forge.debug` API and related functions were removed in 1.0.0. Workarounds Don't use the `forge.debug` API directly or indirectly with untrusted input. References • https://www.huntr.dev/bounties/1-npm-node-forge/ For more information If you have any questions or comments about this advisory: • Open an issue in forge. • Email us at [email protected].

Related

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References