Bhaswanthc

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths. A name-constrained certificate authority with a non-critical extension can therefore issue a leaf certificate with a subjectAltName dNSName or subject commonName outside a permitted subtree or inside an excluded subtree, and node-forge accepts the chain. Exploitation requires a name-constrained CA that chains to a trusted root and either its private key or the ability to obtain an out-of-scope certificate, allowing impersonation of names outside the delegated namespace, including against forge.tls clients. Chains without nameConstraints are not affected, and affected versions safely reject critical nameConstraints as unsupported rather than accepting them. This issue is fixed in version 1.4.3.

The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via `customArgs` to the `git.clone()` function. This allows Git to load an attacker-controlled configuration file through `include.path` or `includeIf.<condition>.path`. A malicious configuration can define an executable Git option, such as `core.sshCommand`, which is then executed with the privileges of the Node.js process during the clone operation. Successful exploitation requires the application to accept attacker-influenced custom arguments and the existence of a readable attacker-controlled file.

An arbitrary file overwrite issue exists in the `IndexFile.from tree()`, `IndexFile.reset()`, and `IndexFile.merge tree()` methods. These methods append caller-influenced treeish strings to the git read-tree command without proper option validation or argument separation. This allows attackers to inject the `--index-output` option to overwrite arbitrary files with a valid git-index blob, resulting in the destruction of existing file content at writable paths controlled by the attacker.

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.