CVE-2022-0122: Open Redirect in node-forge
Summary
CVE-2022-0122: Open Redirect in node-forge. Affects node-forge versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-forge is an open-source cryptographic library for JavaScript that provides a set of cryptographic utilities. It is commonly used for tasks such as encryption, decryption, digital signatures, and certificate management. The library is widely adopted in various applications and frameworks. However, a vulnerability has been discovered in the parseUrl functionality of node-forge, which mishandles certain uses of backslashes, leading to an open redirect vulnerability.
Vulnerability Detail
The parseUrl functionality in node-forge incorrectly interprets the URI as a relative path when encountering certain uses of backslashes, such as 'https:///'. This can result in an open redirect vulnerability, where an attacker can craft a malicious URL that redirects users to a different website. This vulnerability can be exploited to trick users into visiting malicious websites, potentially leading to further attacks such as phishing or the execution of arbitrary code.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install node-forge@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install node-forge@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the node-forge package to the fixed version to mitigate the risk of open redirect attacks.
Conclusion
The open redirect vulnerability in node-forge can have severe consequences, including phishing attacks and the execution of arbitrary code. It is crucial to update the node-forge package to version 1.0.0 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-forge →
FAQ
Node-forge is an open-source cryptographic library for JavaScript that provides a set of cryptographic utilities.
An open redirect vulnerability occurs when a web application allows external input to influence the destination of a redirect, potentially leading to malicious websites.
An attacker can craft a malicious URL that takes advantage of the open redirect vulnerability in node-forge, tricking users into visiting a different website.
This vulnerability can be leveraged for phishing attacks, where users are redirected to fake websites to steal their credentials or sensitive information. It can also be used to execute arbitrary code on the user's system.
Yes, updating the node-forge package to version 1.0.0 or later will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for node-forge.
