{"id":"CVE-2020-7720","aliases":["CLSA-2026-1793814373","DEBIAN-CVE-2020-7720","EUVD-2020-0922","GHSA-92xj-mqp7-vmcj","GHSA-gf8q-jrpm-jvxq","ROOT-APP-NPM-CVE-2020-7720","ROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq","UBUNTU-CVE-2020-7720"],"status":"published","title":"Prototype Pollution","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03188,"percentile":0.88175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-601","CWE-915"],"published":"2020-09-01T09:35:12Z","modified":"2026-11-05T01:00:02Z","fixes":[{"ecosystem":"npm","package":"node-forge","fixed_in":["0.10.0","1.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"node-node-forge","fixed_in":["0.10.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"node-forge","fixed_in":["0.7.1-aikido.2","0.7.1-aikido.3","0.7.1-aikido.4","0.7.6-aikido.1","0.7.1-aikido.5","0.7.1-aikido.6","0.7.1-aikido.7","0.7.6-aikido.2","0.9.0-aikido.1","0.9.0-aikido.2","0.10.0-aikido.2","0.10.0-aikido.3","0.10.0-aikido.4","1.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/node-forge","fixed_in":["0.7.1-root.io.2","0.7.1-root.io.1","0.7.1-root.io.3","0.7.1-root.io.4","0.7.6-root.io.1","0.7.1-root.io.5","0.7.1-root.io.6","0.7.1-root.io.7","0.7.6-root.io.2","0.9.0-root.io.1","0.9.0-root.io.2","0.10.0-root.io.2","0.10.0-root.io.1","0.10.0-root.io.3","0.10.0-root.io.4","1.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0-tuxcare.0"},{"fixed":"0.9.0-tuxcare.1"}]}],"versions":["0.9.0"],"bundled":7},{"source":"osv","ecosystem":"Debian:11","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"node-forge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.0"}]}]},{"source":"osv","ecosystem":"npm","package":"node-forge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-aikido.2"},{"fixed":"0.7.1-aikido.3"},{"fixed":"0.7.1-aikido.4"},{"fixed":"0.7.6-aikido.1"},{"fixed":"0.7.1-aikido.5"},{"fixed":"0.7.1-aikido.6"},{"fixed":"0.7.1-aikido.7"},{"fixed":"0.7.6-aikido.2"},{"fixed":"0.9.0-aikido.1"},{"fixed":"0.9.0-aikido.2"},{"fixed":"0.10.0-aikido.2"},{"fixed":"0.10.0-aikido.3"},{"fixed":"0.10.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-root.io.2"},{"fixed":"0.7.1-root.io.1"},{"fixed":"0.7.1-root.io.3"},{"fixed":"0.7.1-root.io.4"},{"fixed":"0.7.6-root.io.1"},{"fixed":"0.7.1-root.io.5"},{"fixed":"0.7.1-root.io.6"},{"fixed":"0.7.1-root.io.7"},{"fixed":"0.7.6-root.io.2"},{"fixed":"0.9.0-root.io.1"},{"fixed":"0.9.0-root.io.2"},{"fixed":"0.10.0-root.io.2"},{"fixed":"0.10.0-root.io.1"},{"fixed":"0.10.0-root.io.3"},{"fixed":"0.10.0-root.io.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-node-forge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.5~dfsg-2","0.9.1~dfsg-1"]}],"products":[{"vendor":"digital bazaar","product":"node-forge"},{"vendor":"digitalbazaar","product":"forge"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7720","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed","tags":["web"]},{"url":"https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-92xj-mqp7-vmcj"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-gf8q-jrpm-jvxq","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0122","tags":["advisory"]},{"url":"https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gf8q-jrpm-jvxq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7720","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge","tags":["package","web"]},{"url":"https://ubuntu.com/security/CVE-2020-7720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7720","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7720","title":"Prototype Pollution","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T09:35:12.869Z","modified":"2024-09-16T17:49:31.304Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-0922","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T09:35:12Z","modified":"2024-09-16T17:49:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical"}],"updated_at":"2026-11-03T00:55:38.288771Z"}],"ghsa":[{"id":"GHSA-92xj-mqp7-vmcj","title":"Prototype Pollution in node-forge","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-14T21:42:09Z","modified":"2025-02-12T05:11:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"cwes":["CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:38:30.754382Z"},{"id":"GHSA-gf8q-jrpm-jvxq","title":"URL parsing in node-forge could lead to undesired behavior.","description":"### Impact\nThe regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.\n\n### Patches\n`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.\n\n### Workarounds\nEnsure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.\n\n### References\n- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [forge](https://github.com/digitalbazaar/forge)\n* Email us at support@digitalbazaar.com\n","status":"published","published":"2022-01-08T00:22:02Z","modified":"2023-01-11T05:08:11Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"nvd":[{"id":"CVE-2020-7720","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T10:15:10.607Z","modified":"2026-06-17T03:25:19.64Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"CVE-2020-7720","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T10:15:10.607Z","modified":"2026-10-20T10:54:23.857257774Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7720","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T10:15:10.607Z","modified":"2026-08-27T13:03:15.99502245Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-92xj-mqp7-vmcj","title":"Prototype Pollution in node-forge","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-14T21:42:09Z","modified":"2025-01-14T08:57:27.810691Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2020-7720","description":"The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.","status":"published","published":"2020-09-01T10:15:00Z","modified":"2025-10-24T04:48:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"CLSA-2026-1793814373","title":"TuxCare security update for node-forge (8 CVEs)","description":"TuxCare rebuilt node-forge to address 8 CVEs. Fixed in 0.9.0-tuxcare.1.","status":"published","published":"2026-11-04T18:46:13Z","modified":"2026-11-05T01:00:02.601090438Z","updated_at":"2026-11-05T01:12:05.565404Z"},{"id":"GHSA-gf8q-jrpm-jvxq","title":"URL parsing in node-forge could lead to undesired behavior.","description":"### Impact\nThe regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.\n\n### Patches\n`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.\n\n### Workarounds\nEnsure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.\n\n### References\n- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [forge](https://github.com/digitalbazaar/forge)\n* Email us at support@digitalbazaar.com\n","status":"published","published":"2022-01-08T00:22:02Z","modified":"2022-01-07T22:20:43Z","cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"ROOT-APP-NPM-CVE-2020-7720","title":"CVE-2020-7720 in node-forge - Patched by Root","description":"Root has patched CVE-2020-7720 in the node-forge package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-12T11:59:17Z","modified":"2026-10-12T12:15:04.910808887Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-gf8q-jrpm-jvxq","title":"GHSA-gf8q-jrpm-jvxq in node-forge - Patched by Root","description":"Root has patched GHSA-gf8q-jrpm-jvxq in the node-forge package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-27T11:32:45Z","modified":"2026-08-27T13:45:03.511739625Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}