WS-2018-0159

The njwt npm module, version 0.4.0 and lower, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed e.g. from JSON...

EUVD-2024-1390

Malicious code in bioql PyPI...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

@okta/jwt-verifier (3.2.1) potentially affected by CVE-2024-34273 via njwt (2.0.0)

njwt NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on njwt and may be impacted: - @okta/jwt-verifier 3.2.1 Source cves: CVE-2024-34273 Source advisory: OSV:GHSA-3HVJ-2783-34X2...

njwt Prototype Pollution vulnerability

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

The njwt library (up to v0.4.0 ) is vulnerable to a prototype pollution flaw within the Parser.prototype.parse method. This vulnerability, identified as CWE-1312 , allows for the improperly controlled modification of object prototype attributes. Impacted versions include v0.4.0 and earlier, and t...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

CVE-2024-34273

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

njwt 安全漏洞

njwt is the cleanest JSON Web Token JWT library for Node.js developers. A security vulnerability exists in njwt version v0.4.0 and earlier, which stems from the inclusion of a prototype contamination vulnerability found in the Parser.prototype.parse method...

PT-2024-25776 · Njwt · Njwt

Name of the Vulnerable Software and Affected Versions: njwt versions up to 0.4.0 Description: The issue is related to a prototype pollution in the Parser.prototype.parse method. This method is part of the njwt library, which suggests the pollution occurs during the parsing process, potentially...

CVE-2024-34273: Improperly Controlled Modification of Object Prototype Attributes

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...

Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

GHSA-G3QW-9PGP-XPJ4 Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

PT-2020-21294

Name of the Vulnerable Software and Affected Versions njwt versions prior to 1.0.0 Description The issue concerns out-of-bounds reads that occur when a number is passed into the base64urlEncode function. This can lead to exposure of sensitive information on Node.js 6.x or lower, and it creates a...

Out-of-bounds Read

Overview Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendatio...

Uninitialized Buffer Allocation

njwt is vulnerable to uninitialized buffer allocation attacks. The library contains an uninitialized memory allocation when handling a large number, which can allow a malicious user to gain access to sensitive information or crash the application...

Node.js third-party modules: `njwt` allocates uninitialized Buffers when number is passed in base64urlEncode input

I would like to report an uninitialized Buffer allocation issue in njwt. It allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed e.g. from JSON. Module module name: njwt version: 0.4.0 npm page:...