Prototype Pollution in node-forge util.setPath API
Summary
GHSA-wxgw-qj99-44c2: Prototype Pollution in node-forge util.setPath API. Affects node-forge versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-forge package is an implementation of cryptographic functions and utilities for Node.js. It provides a set of APIs for handling various cryptographic operations such as encryption, decryption, signing, and verification. The package is widely used in applications that require secure communication and data protection. However, a vulnerability has been discovered in the util.setPath API of node-forge, which could lead to prototype pollution if called with untrusted keys.
Vulnerability Detail
The util.setPath API in node-forge had a potential prototype pollution issue when used with untrusted keys. This API was not utilized by node-forge itself, but if called with untrusted input, it could result in the pollution of the prototype chain. Prototype pollution is a vulnerability that allows an attacker to modify the behavior of existing objects or introduce new properties into the prototype chain. This could lead to various security issues such as remote code execution, privilege escalation, or denial of service. The vulnerability was assigned CVE-2020-7720.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install node-forge@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.0
This is the first release that contains the fix.
npm install node-forge@0.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of this vulnerability, developers should avoid calling the forge.util.setPath API directly or indirectly with untrusted keys. It is recommended to validate and sanitize all input before using it with any APIs or functions in node-forge.
Conclusion
The node-forge package had a vulnerability in the util.setPath API that could lead to prototype pollution if called with untrusted keys. This vulnerability has been addressed in version 0.10.0 of the package by removing the vulnerable API. Developers using node-forge should update their package to the latest version and ensure that all input is validated and sanitized to mitigate the risk of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-forge →
FAQ
Node-forge is a cryptographic library for Node.js that provides various functions and utilities for encryption, decryption, signing, and verification.
Prototype pollution is a vulnerability that allows an attacker to modify the behavior of existing objects or introduce new properties into the prototype chain.
The impact of this vulnerability depends on how the forge.util.setPath API is used in the application. It could potentially lead to remote code execution, privilege escalation, or denial of service.
Yes, the vulnerability has been fixed in version 0.10.0 of the node-forge package by removing the vulnerable API.
To protect your application, make sure to update the node-forge package to version 0.10.0 or later. Additionally, validate and sanitize all input before using it with any APIs or functions in node-forge.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-forge.
