Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Summary Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allowmissingorfailed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. Details This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS...

CVE-2025-64527

Envoy vulnerability CVE-2025-64527: In versions 1.33.12, 1.34.10, 1.35.6, 1.36.2 and earlier, a re-entry bug in JwksFetcherImpl triggers a crash when JWT authentication uses remote JWKS with allow_missing_or_failed and multiple tokens in headers if the JWKS fetch fails. The first token’s JWKS fet...

CVE-2025-64527 Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allowmissingorfailed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch...

BIT-ACTIVEMQ-2020-11998

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack:...

Malicious code in singularitarianism-europa-spectroscopy-lithosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcf21e8228fd9e543c8d29d6cec97227cb7d7ec7a78be07db67bbd5b7d813a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-perseus-despina-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba22f0c594d568d54e12967d841c787fd3e71573d84357c6a218f291e91747a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-backend-jsonp-orogeny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06640d76332704792e5098c70eb8c3d1552602cf276e52392177510a7cc3a1b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobic-gob-gvatufagi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad99c325aa7d22b00a4f8f02cdd4677d7304c4148409e13f741d18b90608e09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181970 Malicious code in flights-lutag-obolavuhaduli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 287c45c748bf11a549c6361ae5c2996f822777042af00c5f93d49dc66ac3e7d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-oliuka-tamoaki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bd7b6c063bca1df642843f124538ef0a733f8e7022b16e4117664f748d51dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183282 Malicious code in kisut-diug-danugamifoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6a1ecb444dd60c61287d188271161f85a805e7149db66f4c1776fdd066a348f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184035 Malicious code in mitoko-ontcami-lamokoina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745f4f8e0841b9ece9530aca36763c3c2d14433705b2cfdfc02dffeaea0b8fc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184257 Malicious code in modiov-khan-avcafd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62bcc080696620753cd341e5af281a6d59099ee273433d0c0500653c71d581a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181183 Malicious code in @akunsansan0/batu19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed32b0c19fccdf83e1bc2d0f8e9476a5afe83396dc663283a4964c6dc26c81db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-rapuj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c8e614dde159ae7b0089be2a74345267a9ad9a18794a170d6a291094058dbd2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177503 Malicious code in poglymer-ognbamoah-afiagai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4a0121c12caf5598826fe636ec584dbd935c7d13fe841b60720a57830b4ad98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175767 Malicious code in kupaio-kullaa-jijoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 260d2d82ddb040adc3772aa4dfe17243f9d3a9364f4d0685859d082d3c5abb6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173432 Malicious code in buta-fipana-inafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05ce31cb3ef613587728b2c43054723ddd59af102db1642759e87569f2e37c39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-143401

Malicious code in anidata-hadis-re npm...

Malicious code in abdazizfaiz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b29fe9185e741918506282fe04b67f40f5195b4db768ef1237debea5849d55e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...