ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (node-forge)
Highnpm package (node-forge)

node-forge 1.4.0 and earlier: RSA signature forgery and a denial-of-service flaw, update to 1.4.1

Node.js developers whose apps or dependencies use node-forge to check signatures, certificates or other encrypted data.

How to fix it

You haveUpdate to
<= 1.4.0→1.4.1

Check your version

Which version your project has
npm ls node-forge

Update

In your project
npm update node-forge
npm ls node-forge
Still old? A dependency pins it
npm explain node-forge
Then check what's left
npm audit

The worse flaw lets an attacker forge an RSA signature, certificate or PKCS#7 signature without the private key, but only when the verifying key has a low public exponent such as e=3. The other lets crafted ASN.1 data tie up the process. node-forge often arrives as a dependency of another package, so check your lockfile.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources