URL parsing vulnerability in node-forge
Summary
GHSA-gf8q-jrpm-jvxq: URL parsing in node-forge could lead to undesired behavior. Affects node-forge versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-forge is an open-source JavaScript library that provides cryptographic functionality for web applications. It offers a wide range of cryptographic algorithms and utilities. However, a vulnerability has been discovered in the URL parsing functionality of node-forge.
Vulnerability Detail
The vulnerability in node-forge's URL parsing functionality arises from the improper parsing of certain inputs by the forge.util.parseUrl API. This can result in a parsed data structure that may lead to undesired behavior. The issue has been assigned a low severity level (CWE-601) and was identified on January 8, 2022. The vulnerability has been reviewed and confirmed by GitHub.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install node-forge@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install node-forge@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating node-forge is not immediately possible, it is crucial to ensure that untrusted input is not directly or indirectly passed to the forge.util.parseUrl API. Implementing proper input validation and sanitization can help mitigate the risk of exploitation.
Conclusion
In conclusion, the URL parsing vulnerability in node-forge's forge.util.parseUrl API can lead to undesired behavior. It is crucial to update node-forge to version 1.0.0 or later to mitigate this vulnerability. If immediate updating is not possible, ensure that untrusted input is not passed to the affected API. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-forge →
FAQ
node-forge is an open-source JavaScript library that provides cryptographic functionality for web applications. It offers various cryptographic algorithms and utilities.
The vulnerability in node-forge's URL parsing functionality can lead to undesired behavior. However, the severity of the impact is considered low.
To fix this vulnerability, update node-forge to version 1.0.0 or later. The affected URL parsing APIs have been removed, and developers are advised to use the WHATWG URL Standard API instead.
If updating node-forge is not immediately feasible, ensure that untrusted input is not directly or indirectly passed to the forge.util.parseUrl API. Implement proper input validation and sanitization to mitigate the risk.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-gf8q-jrpm-jvxq/GHSA-gf8q-jrpm-jvxq.json
References
Related vulnerabilities
Recent vulnerabilities recorded for node-forge.
