Security vulnerability on the module node-forge

🐛 bug report

There is a security vulnerability on the module node-forge. Here is the link of the information about the vulnerability: https://www.npmjs.com/advisories/1561

🤔 Expected Behavior

No security vulnerabilities when you execute npm audit

😯 Current Behavior

There is a security vulnerability when you execute npm audit

Here is he terminal message:

                       === npm audit security report ===                        


                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           


  High            Prototype Pollution in node-forge                             

  Package         node-forge                                                    

  Patched in      >= 0.10.0                                                     

  Dependency of   parcel [dev]                                                  

  Path            parcel > node-forge                                           

  More info       https://npmjs.com/advisories/1561

💁 Possible Solution

Execute an npm audit fix will solve the issue

🔦 Context

I’m a developer using this npm package and it affect my app.

[mohameddahrouj]

I also came across this issue. The latest stable version looks to be v1.12.4 which depends on v0.7.6 of node-forge. The next version that resolves the vulnerability and references v0.10.0 of node-forge is v2.0.0-beta.1.

[mmikhalko]

Please provide the patch for v1, I won’t use v2 as a beta!