Skip to main content
cve.nowby Sazabi
← npm
npmPackage

jsonwebtoken

4 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 medium
Registry
npm

Advisories 4

  • CVE-2022-23539Medium 5.9

    jsonwebtoken unrestricted key type could lead to legacy keys usage

    Affected: fixed in 9.0.0.

  • CVE-2022-23540Medium 6.4

    jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

    Affected: fixed in 9.0.0.

  • CVE-2022-23541Medium 5.0

    jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

    Affected: fixed in 9.0.0.

  • In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an…

    Affected: fixed in 4.2.2.