latest non vulnerable version
2 years ago
latest version published
a month ago
Known vulnerabilities in the jose-browser-runtime package. This does not include vulnerabilities belonging to this package’s dependencies.Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
jose-browser-runtime is a (Browser Runtime) 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies
Affected versions of this package are vulnerable to Denial of Service (DoS) by allowing an attacker to intentionally pick an extremely high
Note: The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (
How to fix Denial of Service (DoS)?
<3.20.4 >=4.0.0 <4.9.2