Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTh2NWYtaHA3OC1qZ3hx

Signature Verification Bypass in jwt-simple

Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode() function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).

Recommendation

Upgrade to version 0.5.3 or later.

Permalink: https://github.com/advisories/GHSA-8v5f-hp78-jgxq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTh2NWYtaHA3OC1qZ3hx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 5 years ago
Updated: over 1 year ago

Identifiers: GHSA-8v5f-hp78-jgxq
References:

• https://github.com/hokaccha/node-jwt-simple/commit/ead36e1d687645da9c3be8befdaaef622ea33106
• https://www.npmjs.com/advisories/831
• https://github.com/advisories/GHSA-8v5f-hp78-jgxq

Repository: https://github.com/hokaccha/node-jwt-simple
Blast Radius: 0.0

Affected Packages