CVE-2022-0122
Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
- Record
CVE-2022-0122- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-0527
forge is vulnerable to URL Redirection to Untrusted Site
- Record
EUVD-2022-0527- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fr3-hfg3-gpgp
Open Redirect in node-forge
parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
- Record
GHSA-8fr3-hfg3-gpgp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5rrq-pxf6-6jx5 No score
Prototype Pollution in node-forge debug API.
Impact
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Patches
The forge.debug API and related functions were removed in 1.0.0.
Workarounds
Don't use the forge.debug API directly or indirectly with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at [email protected].
- Record
GHSA-5rrq-pxf6-6jx5- Weakness
- CWE-1321
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gf8q-jrpm-jvxq No score
URL parsing in node-forge could lead to undesired behavior.
Impact
The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.
Patches
forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.
Workarounds
Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at [email protected]
- Record
GHSA-gf8q-jrpm-jvxq- Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
forge is vulnerable to URL Redirection to Untrusted Site
- Record
CVE-2022-0122- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Show 9 moreShow less
OSV
Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
- Record
CVE-2022-0122- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-8fr3-hfg3-gpgp
Open Redirect in node-forge
parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
- Record
GHSA-8fr3-hfg3-gpgp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVCLSA-2026-1774916733 No score
TuxCare security update for node-forge (4 CVEs)
TuxCare rebuilt node-forge to address 4 CVEs. Fixed in 0.10.0-tuxcare.4.
- Record
CLSA-2026-1774916733- Updated
- 2026-11-02
OSVCLSA-2026-1793814373 No score
TuxCare security update for node-forge (8 CVEs)
TuxCare rebuilt node-forge to address 8 CVEs. Fixed in 0.9.0-tuxcare.1.
- Record
CLSA-2026-1793814373- Updated
- 2026-11-05
OSVGHSA-5rrq-pxf6-6jx5 No score
Prototype Pollution in node-forge debug API.
Impact
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Patches
The forge.debug API and related functions were removed in 1.0.0.
Workarounds
Don't use the forge.debug API directly or indirectly with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at [email protected].
- Record
GHSA-5rrq-pxf6-6jx5- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-gf8q-jrpm-jvxq No score
URL parsing in node-forge could lead to undesired behavior.
Impact
The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.
Patches
forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.
Workarounds
Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge
- Email us at [email protected]
- Record
GHSA-gf8q-jrpm-jvxq- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-0122 No score
CVE-2022-0122 in node-forge - Patched by Root
Root has patched CVE-2022-0122 in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-0122- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-5rrq-pxf6-6jx5 No score
GHSA-5rrq-pxf6-6jx5 in node-forge - Patched by Root
Root has patched GHSA-5rrq-pxf6-6jx5 in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-5rrq-pxf6-6jx5- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq No score
GHSA-gf8q-jrpm-jvxq in node-forge - Patched by Root
Root has patched GHSA-gf8q-jrpm-jvxq in the node-forge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-forgenpm |
before 1.0.0 | 1.0.0 |
node-forgeTuxCare:npm From an advisory covering 3 CVEs |
0.10.0-tuxcare.0 up to 0.10.0-tuxcare.4, plus listed versions 0.10.00.10.0-tuxcare.10.10.0-tuxcare.20.10.0-tuxcare.3 |
0.10.0-tuxcare.4 |
node-forgeTuxCare:npm From an advisory covering 7 CVEs |
0.9.0-tuxcare.0 up to 0.9.0-tuxcare.1, plus listed versions 0.9.0 |
0.9.0-tuxcare.1 |
node-forgeRoot:npm |
before 0.10.0-aikido.3 | 0.10.0-aikido.30.7.1-aikido.50.7.1-aikido.60.7.1-aikido.70.7.6-aikido.20.10.0-aikido.41.0.0-aikido.1 |
@rootio/node-forgeRoot:npm |
before 0.10.0-root.io.3 | 0.10.0-root.io.30.7.1-root.io.50.7.1-root.io.60.7.1-root.io.70.7.6-root.io.20.10.0-root.io.41.0.0-root.io.1 |
node-forgeRoot:npm |
before 1.0.0-aikido.1 | 1.0.0-aikido.1 |
@rootio/node-forgeRoot:npm |
before 1.0.0-root.io.1 | 1.0.0-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0122 is a medium vulnerability (CVSS 5.3) in Digitalbazaar Digitalbazaar/forge, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in node-forge 1.0.0.
References
huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae
github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e
nvd.nist.gov/vuln/detail/CVE-2022-0122