CVE-2022-23539

CVE-2022-23539 affects jsonwebtoken versions ≤ 8.5.1, where misconfiguration could allow legacy insecure key types to be used for signature verification (e.g., DSA with RS256). The issue has been fixed in v9.0.0, which validates asymmetric key type/algorithm combinations. After upgrading, if you ...

CVE-2022-23540

CVE-2022-23540 affects the jsonwebtoken library. In versions

CVE-2022-23541

CVE-2022-23541 affects jsonwebtoken library (

CVE-2015-9235

CVE-2015-9235 affects the jsonwebtoken Node.js module (pre-4.2.2). The vulnerability allows bypass of token verification when a token signed with RS/ES (asymmetric) is presented but validated with a symmetric HS* algorithm due to weak validation of the JWT algorithm type. This leads to potential ...