MediumGHSA-8fr3-hfg3-gpgpCVE-2022-0122

Open Redirect in node-forge

Published 21 Jan 2022 · Updated 8 Nov 2023

Affected package

Affected: <1.0.0
Fixed in: 1.0.0

Update to the fixed version for your release line, for example:npm install node-forge@1.0.0

Details

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Is GHSA-8fr3-hfg3-gpgp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected node-forge, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-0122
Linkgithub.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e
Packagegithub.com/digitalbazaar/forge
Linkhuntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.