WS-2016-0074

Signature replacement attack in the jsjws package allows attackers to bypass the verification step if a server is expecting a token signed with RSA, but actually receives a token signed with HMAC...

anvil-connect (>=0.1.24, <=0.1.36), anvil-connect-jwt (0.1.2) potentially affected by unknown CVE via jsjws (0.7.7)

jsjws NPM version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on jsjws and may be impacted: - anvil-connect =0.1.24, =0.1.36 - anvil-connect-jwt 0.1.2 Source cves: unknown CVE Source advisory: MEND:WS-2016-0074...

WS-2015-0048

jsjws 2.0.2 and before validation accepts any supported algorithm as valid including none...

anvil-connect (>=0.1.24, <=0.1.36), anvil-connect-jwt (0.1.2) potentially affected by unknown CVE via jsjws (0.7.7)

jsjws NPM version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on jsjws and may be impacted: - anvil-connect =0.1.24, =0.1.36 - anvil-connect-jwt 0.1.2 Source cves: unknown CVE Source advisory: MEND:WS-2015-0048...