CVE-2020-7720
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
| Software | From | Fixed in |
|---|---|---|
| digitalbazaar / forge | - | 0.10.0 |
digitalbazaar / node-forge
|
- | 0.10.0 |
- https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md
- https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed
- https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime