CVE-2022-23539

CVE-2022-23539 affects jsonwebtoken versions ≤ 8.5.1, where misconfiguration could allow legacy insecure key types to be used for signature verification (e.g., DSA with RS256). The issue has been fixed in v9.0.0, which validates asymmetric key type/algorithm combinations. After upgrading, if you ...

Input validation

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

CVE-2022-23540 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...