CVE-2020-7720
Prototype Pollution
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Prototype Pollution
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
CVE-2020-7720- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Updated
- 2026-11-02
EUVDEUVD-2020-0922
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
EUVD-2020-0922- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92xj-mqp7-vmcj
Prototype Pollution in node-forge
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
GHSA-92xj-mqp7-vmcj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Weakness
- CWE-915, CWE-1321
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gf8q-jrpm-jvxq No score
URL parsing in node-forge could lead to undesired behavior.
Impact
The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.
Patches
forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.
Workarounds
Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at [email protected]
- Record
GHSA-gf8q-jrpm-jvxq- Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
CVE-2020-7720- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
CVE-2020-7720- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2020-7720
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
DEBIAN-CVE-2020-7720- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-92xj-mqp7-vmcj
Prototype Pollution in node-forge
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
GHSA-92xj-mqp7-vmcj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Weakness
- CWE-1321, CWE-915
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7720
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
- Record
UBUNTU-CVE-2020-7720- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1793814373 No score
TuxCare security update for node-forge (8 CVEs)
TuxCare rebuilt node-forge to address 8 CVEs. Fixed in 0.9.0-tuxcare.1.
- Record
CLSA-2026-1793814373- Updated
- 2026-11-05
OSVGHSA-gf8q-jrpm-jvxq No score
URL parsing in node-forge could lead to undesired behavior.
Impact
The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.
Patches
forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.
Workarounds
Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at [email protected]
- Record
GHSA-gf8q-jrpm-jvxq- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2020-7720 No score
CVE-2020-7720 in node-forge - Patched by Root
Root has patched CVE-2020-7720 in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2020-7720- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq No score
GHSA-gf8q-jrpm-jvxq in node-forge - Patched by Root
Root has patched GHSA-gf8q-jrpm-jvxq in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-forgenpm |
before 0.10.0 | 0.10.0 |
node-forgenpm |
before 1.0.0 | 1.0.0 |
node-forgeTuxCare:npm From an advisory covering 7 CVEs |
0.9.0-tuxcare.0 up to 0.9.0-tuxcare.1, plus listed versions 0.9.0 |
0.9.0-tuxcare.1 |
node-node-forgeDebian:11 |
before 0.10.0~dfsg-1 | 0.10.0~dfsg-1 |
node-forgeRoot:npm |
before 0.7.1-aikido.2 | 0.7.1-aikido.20.7.1-aikido.30.7.1-aikido.40.7.6-aikido.10.7.1-aikido.50.7.1-aikido.60.7.1-aikido.70.7.6-aikido.20.9.0-aikido.10.9.0-aikido.20.10.0-aikido.20.10.0-aikido.30.10.0-aikido.4 |
@rootio/node-forgeRoot:npm |
before 0.7.1-root.io.2 | 0.7.1-root.io.20.7.1-root.io.10.7.1-root.io.30.7.1-root.io.40.7.6-root.io.10.7.1-root.io.50.7.1-root.io.60.7.1-root.io.70.7.6-root.io.20.9.0-root.io.10.9.0-root.io.20.10.0-root.io.20.10.0-root.io.10.10.0-root.io.30.10.0-root.io.4 |
node-forgeRoot:npm |
before 1.0.0-aikido.1 | 1.0.0-aikido.1 |
@rootio/node-forgeRoot:npm |
before 1.0.0-root.io.1 | 1.0.0-root.io.1 |
node-node-forgeUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.5~dfsg-20.9.1~dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, cwes, facts, references | OSV | |
| aliases, products, published | EUVD | |
| first indexed | GitHub Advisories, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7720 is a critical vulnerability (CVSS 9.8) in Digital Bazaar Node-forge, published September 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. Fixed in node-forge 0.10.0.
References
snyk.io/vuln/SNYK-JS-NODEFORGE-598677
github.com/digitalbazaar/forge/blob/master/CHANGELOG.md
nvd.nist.gov/vuln/detail/CVE-2020-7720
Show 8 moreShow less
huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae
security-tracker.debian.org/tracker/CVE-2020-7720
ubuntu.com/security/CVE-2020-7720
cve.org/CVERecord?id=CVE-2020-7720