CVE-2020-7720 Prototype Pollution
Prototype pollution in node-forge allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7720?
CVE-2020-7720 is a critical vulnerability in node-forge, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7720?
2 open source packages ship an affected version, including node-forge. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-forge npm | All versions | 0.10.0 |
node-forge npm | All versions | 0.10.0 |
Products include Digitalbazaar Forge.
How do I fix CVE-2020-7720?
Upgrade node-forge to 0.10.0 or later.
Is CVE-2020-7720 being exploited?
There is no known exploitation of CVE-2020-7720 in the wild and no public exploit code.
Other vulnerabilities in node-forge
- CVE-2025-66031 node-forge ASN.1 Unbounded Recursion
- CVE-2025-12816 CVE-2025-12816
- CVE-2026-33891 Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
- CVE-2026-33894 Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
- CVE-2026-33895 Forge has signature forgery in Ed25519 due to missing S > L check
Sources
Also known as DEBIAN-CVE-2020-7720, GHSA-92xj-mqp7-vmcj, ROOT-APP-NPM-CVE-2020-7720, UBUNTU-CVE-2020-7720.