Sign in
Deutsch English Español Polski
Medium

Open Redirect in node-forge

  • Disclosed: 21.01.2022
  • Updated: 11.10.2026 10:22

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package node-forge < 1.0.0 1.0.0

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-601
Platform
npm
Package
node-forge
Disclosed
21.01.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8fr3-hfg3-gpgp - CC BY 4.0

Vulnerability history: node-forge

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (15) in the archive
Total entries
15
First → latest
09.2020 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 9
  • Medium 3
  • Low 3

Disclosures per year

Severity:
  1. Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
    High · 7.4 CVE-2026-33896 < 1.4.0 1.4.0
  2. Forge has signature forgery in Ed25519 due to missing S > L check
    High · 7.5 CVE-2026-33895 < 1.4.0 1.4.0
  3. Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
    High · 7.5 CVE-2026-33894 < 1.4.0 1.4.0
  4. Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
    High · 7.5 CVE-2026-33891 < 1.4.0 1.4.0
  5. node-forge has ASN.1 Unbounded Recursion
    High CVE-2025-66031 < 1.3.2 1.3.2
  6. node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
    High · 8.6 CVE-2025-12816 < 1.3.2 1.3.2
  7. Improper Verification of Cryptographic Signature in node-forge
    High · 7.5 CVE-2022-24772 < 1.3.0 1.3.0
  8. Improper Verification of Cryptographic Signature in node-forge
    High · 7.5 CVE-2022-24771 < 1.3.0 1.3.0
  9. Open Redirect in node-forge this entry
    Medium · 6.1 CVE-2022-0122 < 1.0.0 1.0.0
  10. Prototype Pollution in node-forge
    High · 9.8 CVE-2020-7720 < 0.10.0 0.10.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.