PT-2022-28202 · Unknown · Node-Forge
Published
2022-01-08
·
Updated
2022-01-08
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
node-forge versions prior to 1.0.0
Description
The issue concerns a potential prototype pollution problem in the
forge.debug API when used with untrusted input. This API was used internally for debug purposes and was not documented or advertised, suggesting its usage with untrusted inputs would be rare.Recommendations
For versions prior to 1.0.0, consider removing or avoiding the use of the
forge.debug API with untrusted input as a temporary workaround. The definitive fix is to update to version 1.0.0 or later, where the forge.debug API and related functions have been removed.Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Node-Forge