CVE-2022-0122

Name of the Vulnerable Software and Affected Versions forge versions prior to 1.0.0

Description The issue concerns a URL redirection vulnerability to untrusted sites. The parseUrl functionality in node-forge mishandles certain uses of backslash, such as https:///, and interprets the URI as a relative path. This could lead to undesired behavior due to improper parsing of certain inputs by the regex used for the forge.util.parseUrl API.

Recommendations For versions prior to 1.0.0, ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input. Consider updating to version 1.0.0 or later, where forge.util.parseUrl and other related URL APIs were removed in favor of the more modern WHATWG URL Standard API.