WS-2018-0159

The njwt npm module, version 0.4.0 and lower, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed e.g. from JSON...

@gaincompliance/hapi-auth-stormpath (>=1.0.0, <=1.1.25), @speakr/speakr-module-services (>=1.1.35, <=1.6.735) +48 more potentially affected by unknown CVE via njwt (>=0.0.1, <=0.4.0)

njwt NPM version =0.0.1, =1.0.0, =1.1.35, =1.0.0, =1.0.0-rc1, =0.0.3, =1.0.0, =1.0.0, =1.0.0, =1.0.7, =1.0.0, =0.0.1, =1.0.0, =1.7.1, =1.7.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2018-0159...

EUVD-2024-1390

Malicious code in bioql PyPI...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

njwt Prototype Pollution vulnerability

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

@okta/jwt-verifier (3.2.1) potentially affected by CVE-2024-34273 via njwt (2.0.0)

njwt NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on njwt and may be impacted: - @okta/jwt-verifier 3.2.1 Source cves: CVE-2024-34273 Source advisory: OSV:GHSA-3HVJ-2783-34X2...

@okta/jwt-verifier (3.2.1) potentially affected by CVE-2024-34273 via njwt (2.0.0)

njwt NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on njwt and may be impacted: - @okta/jwt-verifier 3.2.1 Source cves: CVE-2024-34273 Source advisory: GHSA-3HVJ-2783-34X2...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

The njwt library (up to v0.4.0 ) is vulnerable to a prototype pollution flaw within the Parser.prototype.parse method. This vulnerability, identified as CWE-1312 , allows for the improperly controlled modification of object prototype attributes. Impacted versions include v0.4.0 and earlier, and t...

@adyen/adyen-salesforce-pwa (>=1.0.0-beta.5, <=1.2.0), @argodigital/formula-request (>=1.0.0, <=1.1.1) +135 more potentially affected by CVE-2024-34273 via njwt (>=0.0.1, <=2.0.0)

njwt NPM version =0.0.1, =1.0.0-beta.5, =1.0.0, =0.10.1, =0.1.1, =0.1.0, =0.1.0, =0.2.0, =1.0.0, =1.1.0, =0.0.1, =1.0.0, =1.1.25 - @harrymoore/jwt-proxy 1.0.0 - @iarna/atest 1.1.0 and more Source cves: CVE-2024-34273 Source advisory: MEND:CVE-2024-34273...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273: Improperly Controlled Modification of Object Prototype Attributes

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

PT-2024-25776 · Njwt · Njwt

Name of the Vulnerable Software and Affected Versions: njwt versions up to 0.4.0 Description: The issue is related to a prototype pollution in the Parser.prototype.parse method. This method is part of the njwt library, which suggests the pollution occurs during the parsing process, potentially...

njwt security vulnerabilities

njwt is the cleanest JSON Web Token JWT library for Node.js developers. A security vulnerability exists in njwt version v0.4.0 and earlier, which stems from the inclusion of a prototype contamination vulnerability found in the Parser.prototype.parse method...

Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

GHSA-G3QW-9PGP-XPJ4 Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

PT-2020-21294

Name of the Vulnerable Software and Affected Versions njwt versions prior to 1.0.0 Description The issue concerns out-of-bounds reads that occur when a number is passed into the base64urlEncode function. This can lead to exposure of sensitive information on Node.js 6.x or lower, and it creates a...

Out-of-bounds Read

Overview Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendatio...