JWT libraries vulnerabilities and security advisories

$ latest 7 · 2 critical, high or exploited

• mediumMar 7, 2024

  jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

  • jose >= 3.0.0, <= 4.15.4 · fixed in 4.15.5
  • jose < 2.0.7 · fixed in 2.0.7
  GHSA-hhhv-q57g-882qCVE-2024-28176

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-hhhv-q57g-882q (CVE-2024-28176), severity medium
  What it is: jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
  Affected packages:
  - jose: affected versions >= 3.0.0, <= 4.15.4. Fixed in 4.15.5.
  - jose: affected versions < 2.0.7. Fixed in 2.0.7.
  Details: https://github.com/advisories/GHSA-hhhv-q57g-882q
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumDec 22, 2022

  jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

  • jsonwebtoken <= 8.5.1 · fixed in 9.0.0
  GHSA-hjrf-2m68-5959CVE-2022-23541

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-hjrf-2m68-5959 (CVE-2022-23541), severity medium
  What it is: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
  Affected packages:
  - jsonwebtoken: affected versions <= 8.5.1. Fixed in 9.0.0.
  Details: https://github.com/advisories/GHSA-hjrf-2m68-5959
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumDec 22, 2022

  jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

  • jsonwebtoken < 9.0.0 · fixed in 9.0.0
  GHSA-qwph-4952-7xr6CVE-2022-23540

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-qwph-4952-7xr6 (CVE-2022-23540), severity medium
  What it is: jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
  Affected packages:
  - jsonwebtoken: affected versions < 9.0.0. Fixed in 9.0.0.
  Details: https://github.com/advisories/GHSA-qwph-4952-7xr6
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highDec 22, 2022

  jsonwebtoken unrestricted key type could lead to legacy keys usage

  • jsonwebtoken <= 8.5.1 · fixed in 9.0.0
  GHSA-8cf7-32gw-wr33CVE-2022-23539

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-8cf7-32gw-wr33 (CVE-2022-23539), severity high
  What it is: jsonwebtoken unrestricted key type could lead to legacy keys usage
  Affected packages:
  - jsonwebtoken: affected versions <= 8.5.1. Fixed in 9.0.0.
  Details: https://github.com/advisories/GHSA-8cf7-32gw-wr33
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumSep 16, 2022

  JOSE vulnerable to resource exhaustion via specifically crafted JWE

  • jose >= 1.0.0, <= 1.28.1 · fixed in 1.28.2
  • jose >= 2.0.0, <= 2.0.5 · fixed in 2.0.6
  • jose >= 3.0.0, <= 3.20.3 · fixed in 3.20.4
  • jose >= 4.0.0, <= 4.9.1 · fixed in 4.9.2
  GHSA-jv3g-j58f-9mq9CVE-2022-36083

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-jv3g-j58f-9mq9 (CVE-2022-36083), severity medium
  What it is: JOSE vulnerable to resource exhaustion via specifically crafted JWE
  Affected packages:
  - jose: affected versions >= 1.0.0, <= 1.28.1. Fixed in 1.28.2.
  - jose: affected versions >= 2.0.0, <= 2.0.5. Fixed in 2.0.6.
  - jose: affected versions >= 3.0.0, <= 3.20.3. Fixed in 3.20.4.
  - jose: affected versions >= 4.0.0, <= 4.9.1. Fixed in 4.9.2.
  Details: https://github.com/advisories/GHSA-jv3g-j58f-9mq9
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumApr 19, 2021

  Padding Oracle Attack due to Observable Timing Discrepancy in jose

  • jose >= 1.0.0, < 1.28.1 · fixed in 1.28.1
  • jose >= 2.0.0, < 2.0.5 · fixed in 2.0.5
  • jose >= 3.0.0, < 3.11.4 · fixed in 3.11.4
  GHSA-58f5-hfqc-jgchCVE-2021-29443

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-58f5-hfqc-jgch (CVE-2021-29443), severity medium
  What it is: Padding Oracle Attack due to Observable Timing Discrepancy in jose
  Affected packages:
  - jose: affected versions >= 1.0.0, < 1.28.1. Fixed in 1.28.1.
  - jose: affected versions >= 2.0.0, < 2.0.5. Fixed in 2.0.5.
  - jose: affected versions >= 3.0.0, < 3.11.4. Fixed in 3.11.4.
  Details: https://github.com/advisories/GHSA-58f5-hfqc-jgch
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• criticalOct 9, 2018

  Verification Bypass in jsonwebtoken

  • jsonwebtoken < 4.2.2 · fixed in 4.2.2
  GHSA-c7hr-j4mj-j2w6CVE-2015-9235

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-c7hr-j4mj-j2w6 (CVE-2015-9235), severity critical
  What it is: Verification Bypass in jsonwebtoken
  Affected packages:
  - jsonwebtoken: affected versions < 4.2.2. Fixed in 4.2.2.
  Details: https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.