7 matches found
CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
@erpsquad/common (>=1.0.0, <=1.10.3-spar), @faable/auth-helpers-fastify (>=1.0.2, <=1.0.17) +22 more potentially affected by CVE-2025-59936 via get-jwks (>=4.3.0, <=10.0.0)
get-jwks NPM version =4.3.0, =1.0.0, =1.0.2, =0.4.4, =1.0.0, =1.0.0, =1.0.1, =3.1.0, =2.0.0, =0.1.0, =0.29.0, =0.0.23, =0.0.23, =0.2.0, =0.33.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-59936 Source advisory: MEND:CVE-2025-59936...
CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
CVE-2025-59936
The CVE-2025-59936 issue affects get-jwks prior to 11.0.2, where a design flaw allows cache poisoning of the JWKS cache to bypass issuer validation. If iss is validated after keys are retrieved from the cache, an attacker can craft JWTs to place a chosen public key in the shared cache and then re...
get-jwks security vulnerability
get-jwks is a Nearform open source utility for obtaining JWKS keys. A security vulnerability exists in get-jwks versions prior to 11.0.2, which stems from a cache poisoning issue in the JWKS key fetching mechanism that could lead to bypassing issuer authentication...
CVE-2025-59936: Improper Encoding or Escaping of Output
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...
