auth0/node-jws Improperly Verifies HMAC Signature

🗓️ 04 Dec 2025 16:54:15Reported by GitHub Advisory DatabaseType

Improper HMAC signature verification in auth0/node-jws with HS256 on affected versions.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	30 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	11 Feb 202616:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	12 Mar 202612:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules (CVE-2025-64718, CVE-2025-64756, CVE-2025-13466 & CVE-2025-65945)	22 Dec 202511:27	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	2 Feb 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service (CVE-2025-12758, CVE-2025-13466, CVE-2025-14874) and loss of confidentiality (CVE-2025-65945)	5 Feb 202612:45	–	ibm
IBM Security Bulletins	Security Bulletin: auth0/node-jws HS256 signature verification bypass via improper HMAC secret handling (≤3.2.2, 4.0.0)	3 Feb 202609:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	2 Mar 202611:21	–	ibm
IBM Security Bulletins	Security Bulletin: Signature Verification Bypass Vulnerability in auth0/node-jws (HS256, ≤ v3.2.2 & v4.0.0) affects watsonx.data	8 Apr 202608:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	26 Feb 202610:04	–	ibm

Vulners

Node

go jwsMatch4.0.0npm

go jwsRange<3.2.3npm

Source	Link
github	www.github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
github	www.github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
github	www.github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
github	www.github.com/auth0/node-jws/releases/tag/v3.2.3
github	www.github.com/auth0/node-jws/releases/tag/v4.0.1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-65945
github	www.github.com/advisories/GHSA-869p-cjfg-cm3x

04 Dec 2025 22:50Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.00012

SSVC

CWE-347