jose-node-cjs-runtime@3.11.3 vulnerabilities
-
latest version
5.9.6
-
latest non vulnerable version
-
first published
4 years ago
-
latest version published
a month ago
-
licenses detected
- >=0
Direct Vulnerabilities
Known vulnerabilities in the jose-node-cjs-runtime package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
jose-node-cjs-runtime is a (Node.JS CJS Runtime) 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies Affected versions of this package are vulnerable to Resource Exhaustion due to the JWE decryption interfaces' support for decompressing plaintext after its decryption. An attacker can cause the application to consume an unreasonable amount of CPU time or memory by sending malicious JWE payloads with compressed plaintext. Note: This is only exploitable if the application uses JWE decryption from untrusted sources and runs in a Node.js environment. How to fix Resource Exhaustion? Upgrade |
<4.15.5
|
jose-node-cjs-runtime is a (Node.JS CJS Runtime) 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies Affected versions of this package are vulnerable to Denial of Service (DoS) by allowing an attacker to intentionally pick an extremely high Note: The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms ( How to fix Denial of Service (DoS)? Upgrade |
<3.20.4
>=4.0.0 <4.9.2
|
jose-node-cjs-runtime is a (Node.JS CJS Runtime) 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies Affected versions of this package are vulnerable to Timing Attack. A difference in task execution timing may be observed in the AES_CBC_HMAC_SHA2 Algorithm when a padding error occurs during decryption, which may allow a malicious actor to decrypt data without the key. How to fix Timing Attack? Upgrade |
<3.11.4
|