Executive brief
node-forge is a JavaScript library providing cryptographic utilities and certificate handling. A prototype pollution vulnerability in its util.setPath function could allow an attacker to manipulate JavaScript object prototypes if untrusted keys are passed to this API, potentially affecting application behavior. The library has removed this API in patched versions.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the forge.util.setPath API. When called with untrusted object keys, the function improperly controls modification of object prototype attributes, allowing an attacker to pollute the Object prototype. The attack requires calling the vulnerable API directly or indirectly with attacker-controlled keys. The forge library itself did not use this API internally, limiting the direct impact. The fix involved removing the setPath API and related functions entirely in version 0.10.0.
Affected products
- Digital Bazaar node-forge before 0.10.0
Timeline
- 2022-01-06: disclosed
- 2022-01-08: patched: version 0.10.0