auth0/node-jsonwebtoken Security Advisories | GitStock

medium2022-12-22

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

GHSA-hjrf-2m68-5959 · CVE-2022-23541

medium2022-12-22

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

GHSA-qwph-4952-7xr6 · CVE-2022-23540

high2022-12-22

jsonwebtoken unrestricted key type could lead to legacy keys usage

GHSA-8cf7-32gw-wr33 · CVE-2022-23539