Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/forge/security/advisories/GHSA-6wvx-3r32-xmcg Diğer
• github.com/…ommit/797c3f816a22748a96fceebb34eb3a6716853991 Diğer
• github.com/digitalbazaar/forge/releases/tag/v1.4.1 Diğer

Kayıt geçmişi

1. 29 Eki 2026 21:42Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
• 7,4 CVE-2026-119190Forge (node-forge): verifyCertificateChain üzerinde basicConstraints atlatma açığı
• 5,9 CVE-2026-119189Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
• 7,5 CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
• 7,5 CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion
• 5,9 CVE-2026-119186Forge (node-forge) AES-GCM tagLength doğrulanmadığı için kimlik doğrulama atlatma açığı