The vulnerability is a prototype pollution flaw (CWE-1321) in node-forge's HTTP client. In versions before 1.4.1, cookie names and paths extracted from Set-Cookie response headers are written directly into plain JavaScript objects. A server can therefore send a Set-Cookie header with a name of "__proto__" or use inherited names such as "constructor" to inject properties onto Object.prototype or overwrite existing ones. If the attacker controls the cookie value, the header can also be used to delete inherited properties. This manipulation of Object.prototype can alter the behavior of all objects that inherit from it, potentially leading to corrupted application logic or unauthorized code execution.

This flaw affects any application that uses the forge.http client (or the higher‑level forge.xhr interface) in node-forge prior to version 1.4.1. The vulnerability is not present in applications that do not invoke forge.http, even if they depend on node-forge elsewhere. Users of digitalbazaar:forge, any Node.js project that includes forge.http cookie handling, are impacted until they update to v1.4.1 or later.

The CVSS score of 4.8 indicates a moderate impact. The exploitability is constrained to scenarios where an application makes HTTP requests via forge.http and processes Set-Cookie headers from a reachable server. An attacker can host a malicious server that sends a Set-Cookie header with the name "__proto__" or other injected property names. Public exploitation evidence is not available, and the vulnerability is not listed in CISA's KEV catalog. Because the attack requires a server that the application contacts, it is a remote network‑based vector that does not depend on local privilege escalation or kernel vulnerabilities.