# openpgp (npm) vulnerabilities

6 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/openpgp

## Advisories (6)

### [CVE-2025-47934](https://cve.now/CVE-2025-47934): OpenPGP.js's message signature verification can be spoofed

- Severity: High 8.7
- Published: May 19, 2025
- Affected: from 5.0.1, fixed in 5.11.3; from 6.0.0-alpha.0, fixed in 6.1.1.

### [CVE-2023-41037](https://cve.now/CVE-2023-41037): Cleartext Signed Message Signature Spoofing in openpgpjs

- Severity: Medium 4.3
- Published: Aug 29, 2023
- Affected: fixed in 4.10.11; from 5.0.0, fixed in 5.10.1.

### [CVE-2019-9155](https://cve.now/CVE-2019-9155): A cryptographic issue in OpenPGP.js \<=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether…

- Severity: Unrated
- Published: Aug 22, 2019
- Affected: fixed in 4.3.0.

### [CVE-2019-9154](https://cve.now/CVE-2019-9154): Improper Verification of a Cryptographic Signature in OpenPGP.js \<=4.1.2 allows an attacker to pass off unsigned data as signed.

- Severity: Unrated
- Published: Aug 22, 2019
- Affected: fixed in 4.2.0.

### [CVE-2019-9153](https://cve.now/CVE-2019-9153): Improper Verification of a Cryptographic Signature in OpenPGP.js \<=4.1.2 allows an attacker to forge signed messages by replacing its…

- Severity: Unrated
- Published: Aug 22, 2019
- Affected: fixed in 4.2.0.

### [CVE-2015-8013](https://cve.now/CVE-2015-8013): s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass…

- Severity: Unrated
- Published: Jul 25, 2017
- Affected: fixed in 1.3.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/openpgp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.