Login Request a demo
JS
Product
Jsonwebtoken
by Auth0 · last CVE Dec 22, 2022
4
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 1High 2Medium 1Low 0
Severity
All severities4Critical1High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Jsonwebtoken to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2015-9235
9.8
9%
May 29
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms…
Affected: before 4.2.2
CVE-2022-23539
8.1
1%
Dec 22
jsonwebtoken unrestricted key type could lead to legacy keys usage
Affected: through 8.5.1
CVE-2022-23540
7.6
1%
Dec 22
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
Affected: through 8.5.1
CVE-2022-23541
6.3
1%
Dec 22
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Affected: through 8.5.1
Showing 4