CLSA-2026-1789068227 TuxCare security update for jwt-simple (1 CVE)

TuxCare rebuilt jwt-simple to address 1 CVE. Fixed in 0.3.1-tuxcare.1...

PT-2026-96025

TuxCare rebuilt jwt-simple to address 1 CVE. Fixed in 0.3.1-tuxcare.1...

@amitport/auth-server (0.0.3), @amitport/koangular-users (0.0.0) +319 more potentially affected by unknown CVE via jwt-simple (>=0.1.0, <=0.5.1)

jwt-simple NPM version =0.1.0, =1.0.2, =1.1.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.2.0, =0.10.2, =0.11.2 - @sysdoc/sysdoc-web-stack 1.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0067...

WS-2019-0067

Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 JWT with the server's public key as secret...

MAL-2025-3638 Malicious code in node-jwt-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b327dac41c47c206948d7e146a6174435ee74981c5726827f68050b3692060a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in node-jwt-simple

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

blind-rsa-signatures (0.9.0), jwt-simple (>=0.2.7, <=0.9.3) +1 more potentially affected by unknown CVE via rsa-export (0.3.3)

rsa-export CARGO version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on rsa-export and may be impacted: - blind-rsa-signatures 0.9.0 - jwt-simple =0.2.7, =0.1.2, =0.1.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0333...

Signature Verification Bypass in jwt-simple

Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 symmetric algorithm JWT with the server's public key a...

GHSA-8V5F-HP78-JGXQ Signature Verification Bypass in jwt-simple

Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 symmetric algorithm JWT with the server's public key a...

@amitport/auth-server (0.0.3), @amitport/koangular-users (0.0.0) +319 more potentially affected by unknown CVE via jwt-simple (>=0.1.0, <=0.5.1)

jwt-simple NPM version =0.1.0, =1.0.2, =1.1.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.2.0, =0.10.2, =0.11.2 - @sysdoc/sysdoc-web-stack 1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8V5F-HP78-JGXQ...

@amitport/auth-server (0.0.3), @amitport/koangular-users (0.0.0) +319 more potentially affected by unknown CVE via jwt-simple (>=0.1.0, <=0.5.1)

jwt-simple NPM version =0.1.0, =1.0.2, =1.1.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.2.0, =0.10.2, =0.11.2 - @sysdoc/sysdoc-web-stack 1.0.0 and more Source cves: unknown CVE Source advisory: GHSA-8V5F-HP78-JGXQ...

PT-2019-20029

Name of the Vulnerable Software and Affected Versions jwt-simple versions prior to 0.5.3 Description The issue allows an attacker to bypass signature verification. If no algorithm is specified in the decode function, the package uses the algorithm in the JWT to decode tokens. This enables an...

JWT Signature Verification Bypass

jwt-simple is vulnerable to signature verification bypass. A remote attacker is able to succeed in a JWT verification without specifying an algorithm in the decode function...

Signature Verification Bypass

Overview Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 symmetric algorithm JWT with the server's...

GHSA-VGRX-W6RG-8FQF Forgeable Public/Private Tokens in jwt-simple

Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result ...

@sysdoc/sysdoc-web-stack (1.0.0), ac-koa-hipchat (>=0.1.0, <=0.2.20) +181 more potentially affected by CVE-2016-10555 via jwt-simple (>=0.1.0, <=0.3.0)

jwt-simple NPM version =0.1.0, =0.1.0, =0.1.0, =1.1.0, =0.0.1, =0.1.0, =1.0.0, =0.0.7, =0.2.12, =0.5.3, =0.1.0, =0.0.2, =1.1.1, =1.3.1 and more Source cves: CVE-2016-10555 Source advisory: GHSA-VGRX-W6RG-8FQF...

@sysdoc/sysdoc-web-stack (1.0.0), ac-koa-hipchat (>=0.1.0, <=0.2.20) +181 more potentially affected by CVE-2016-10555 via jwt-simple (>=0.1.0, <=0.3.0)

jwt-simple NPM version =0.1.0, =0.1.0, =0.1.0, =1.1.0, =0.0.1, =0.1.0, =1.0.0, =0.0.7, =0.2.12, =0.5.3, =0.1.0, =0.0.2, =1.1.1, =1.3.1 and more Source cves: CVE-2016-10555 Source advisory: OSV:GHSA-VGRX-W6RG-8FQF...

Forgeable Public/Private Tokens in jwt-simple

Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result ...

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

Code injection

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...