GHSA-5rrq-pxf6-6jx5
GHSA-5rrq-pxf6-6jx5 · Prototype Pollution in node-forge debug API.
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way. ### Patches The `forge.debug` API and related functions were removed in 1.0.0. ### Workarounds Don't use the `forge.debug` API directly or indirectly with untrusted input. ### References - https://www.huntr.dev/bounties/1-npm-node-forge/ ### For more information If you have any questions or comments about this advisory: * Open an issue in [forge](https://github.com/digitalbazaar/forge). * Email us at support@digitalbazaar.com.
Есть исправление
- Опубликовано
- Обновлено
Стек: node
Затронутые продукты и версии
node-forge npm
- Затронутые диапазоны версий
- SEMVER: < 1.0.0
Обновитесь до 1.0.0