{"id":"CVE-2026-118777","aliases":["GHSA-6wvx-3r32-xmcg"],"title":"Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\nThe `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie name and path. A malicious server could use the cookie name `__proto__` to add properties to `Object.prototype`, use inherited names such as `constructor` to add properties to `Object`, and send an empty cookie value to delete `Object.prototype` properties. Fixed in node-forge 1.4.1.\n\n### Details\n`client.setCookie()` in `lib/http.js` stored a cookie with `client.cookies[cookie.name][cookie.path] = cookie`, creating `client.cookies[cookie.name]` only when `!(cookie.name in client.cookies)`. Both values come from the server's `Set-Cookie` header via `response.getCookies()`. Because `in` also sees inherited properties:\n\n- a cookie named `__proto__` skipped the initialization, `client.cookies['__proto__']` returned `Object.prototype`, and the cookie path was written as a new `Object.prototype` property, visible on every object;\n- a cookie named `constructor` wrote onto the global `Object` function the same way;\n- a cookie with an empty value calls `client.removeCookie(name, path)`, which used the same `in` checks and then `delete client.cookies[name][path]`, so `Set-Cookie: __proto__=; path=toString` deleted `Object.prototype.toString`. This path skipped the cookie's secure-flag and domain checks, so it also worked for `http://` clients.\n\n`forge.http` is not loaded by `require('node-forge')`. It is included in the `forge.all` browser bundle and is used with a socket pool, for example by `forge.xhr`.\n\nThe fix uses own-property checks for the cookie store and ignores cookies named `__proto__` or with the path `__proto__`.\n\n#### Patches\nFixed in node-forge 1.4.1. Cookies from a server can no longer add or remove properties of `Object.prototype` or `Object`.\n\n#### Workarounds\nDon't use `forge.http` or `forge.xhr` with servers that aren't trusted, or filter `Set-Cookie` headers named `__proto__`, `constructor` or other `Object.prototype` property names before they reach the client.\n\n#### Credits\nReported by @arunmozhivarman-dtx and @Dremig.\n\n### Proof of concept\nA server response for a `forge.http` client (`http.createClient({url: 'https://...', socketPool: ...})`) containing:\n\n    Set-Cookie: __proto__=evil; path=polluted\n\nOn 1.4.0, after the client processes the response, `({}).polluted` is the cookie object. With `Set-Cookie: __proto__=; path=toLocaleString`, `Object.prototype.toLocaleString` is deleted (for `http://` and `https://` clients). On 1.4.1 these cookies are ignored and `Object.prototype` is unchanged.\n\nRegression tests are in tests/security/ghsa-6wvx-3r32-xmcg.js.\n\n### Impact\nApplications that use the `forge.http` client (directly, or through `forge.xhr` in the `forge.all` browser bundle) against a server that can be malicious are affected. The server can add properties to `Object.prototype` and `Object` for the whole JavaScript realm, which can change application logic that reads properties from plain objects, and can delete built-in `Object.prototype` methods, breaking the page or process. Applications that don't use `forge.http` are not affected.","severity":"medium","score":4.8,"published":"2026-10-29T18:42:06.079Z","modified":"2026-10-30T23:15:05.413Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"node-forge","sources":[{"name":"OSV · GHSA-6wvx-3r32-xmcg","url":"https://osv.dev/vulnerability/GHSA-6wvx-3r32-xmcg"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.4.1"}],"type":"SEMVER"}],"versions":[],"fixed":["1.4.1"]}],"sourceAffected":[],"references":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","https://nvd.nist.gov/vuln/detail/CVE-2026-118777","https://github.com/digitalbazaar/forge"],"sources":[{"name":"CVE","id":"CVE-2026-118777","modified":"2026-10-30T17:12:06.088Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118777"},{"name":"OSV","id":"GHSA-6wvx-3r32-xmcg","modified":"2026-10-30T23:15:05.413239324Z","url":"https://osv.dev/vulnerability/GHSA-6wvx-3r32-xmcg"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","score":4.8},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","score":4.8}],"cve":{"records":[{"id":"CVE-2026-118777","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T19:20:05.018Z","published":"2026-10-29T18:42:06.079Z","modified":"2026-10-30T17:12:06.088Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T18:42:06.079Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:12:06.088Z"}],"references":[{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-1321","description":"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:20:36.875932Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"digitalbazaar","name":"forge","platforms":[],"versions":[{"version":"< 1.4.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118777"}],"remediation":[],"observedAt":"2026-10-30T23:32:56.578Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:10:31.776Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T20:05:39.263Z","attemptedAt":"2026-10-29T20:05:39.263Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T20:05:39.281Z","attemptedAt":"2026-10-29T20:05:39.281Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T20:05:39.984Z","attemptedAt":"2026-10-29T20:05:39.984Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T20:05:40.644Z","attemptedAt":"2026-10-29T20:05:40.644Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118777","modified":"2026-10-29T19:17:20.283","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-29T20:05:39.263Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113335","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113335","modified":"Oct 29, 2026, 6:42:06 PM","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-29T20:05:39.984Z"}],"aiSummary":{"text":"The `forge.http` client in node-forge versions before 1.4.1 is vulnerable to prototype pollution via a malicious `Set-Cookie` header, allowing a server to add or remove properties from `Object.prototype`. This can change application logic and break the page or process.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:06:09.006Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118777"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-6wvx-3r32-xmcg"}]}}