node-jsonwebtoken vulnerabilities

2 known vulnerabilities in node-jsonwebtoken from Auth0. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  node-jsonwebtoken: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2022-23539Dec 23, 2022Auth0

  Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key t

• 7.6 High severity

  node-jsonwebtoken: Improper Verification of Cryptographic Signature

  CVE-2022-23540Dec 22, 2022Auth0

  In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify