GHSA-wxgw-qj99-44c2
Prototype Pollution in node-forge util.setPath API
GHSA-wxgw-qj99-44c2 is a vulnerability with no CVSS score yet in node-forge, published January 8, 2022. No source lists public exploit code. Fixed in node-forge 0.10.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.10.0node-forge
Description
Impact
forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.
Patches
The forge.util.setPath API and related functions were removed in 0.10.0.
Workarounds
Don't call forge.util.setPath directly or indirectly with untrusted keys.
References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at support@digitalbazaar.com.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-forgenpm | before 0.10.0 | 0.10.0 |
What each source reports
GitHub AdvisoriesNo score
Prototype Pollution in node-forge util.setPath API
Impact
forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.
Patches
The forge.util.setPath API and related functions were removed in 0.10.0.
Workarounds
Don't call forge.util.setPath directly or indirectly with untrusted keys.
References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at support@digitalbazaar.com.
- Record
GHSA-wxgw-qj99-44c2- Updated
- 2026-11-02
OSVNo score
Prototype Pollution in node-forge util.setPath API
Impact
forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.
Patches
The forge.util.setPath API and related functions were removed in 0.10.0.
Workarounds
Don't call forge.util.setPath directly or indirectly with untrusted keys.
References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at support@digitalbazaar.com.
- Record
GHSA-wxgw-qj99-44c2- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | ||
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.