Vulnerability detected in node-forge
You could try
npm updateThis should update all packages to the latest version, respecting the semantic versioning rules in your package.json / package-lock.json.
You can also try allowing Dependabot to generate a pull request to fix the issue. If you select the alert itself you should see a button like so:
This will attempt to create a pull request (this won't always succeed) and will take a few minutes usually. Once this is complete you can review and merge.
Causation:
node-forge@0.9.0 needs to be updated to node-forge@^0.10.0
Solution (NPM)
rm -rf node-modules
rm package.lock
npm cache clean
npm i
Solution (Yarn)
rm -rf node_modules
rm yarn.lock
yarn cache clean
yarn
Explanation
This should cause the library that's using node-forge to update its own dependencies.
Vulnerability in node-forge 0.9.0 has been fixed in selfsigned recently. Try updating selfsigned. It fixed the issue for me.Please check the link for reference. Selfsigned github link