jsonwebtoken@8.5.1@8.5.1@8.5.1 8.5.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the jsonwebtoken@8.5.1@8.5.1@8.5.1 package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Use of a Broken or Risky Cryptographic Algorithm jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric) Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm such that the library can be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm. How to fix Use of a Broken or Risky Cryptographic Algorithm? Upgrade `jsonwebtoken` to version 9.0.0 or higher.	<9.0.0
M Improper Restriction of Security Token Assignment jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric) Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the `secretOrPublicKey` argument due to misconfigurations of the key retrieval function `jwt.verify()`. Exploiting this vulnerability might result in incorrect verification of forged tokens when tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. Note: This vulnerability affects your application if it supports the usage of both symmetric and asymmetric keys in `jwt.verify()` implementation with the same key retrieval function. How to fix Improper Restriction of Security Token Assignment? Upgrade `jsonwebtoken` to version 9.0.0 or higher.	<9.0.0
M Improper Authentication jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric) Affected versions of this package are vulnerable to Improper Authentication such that the lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. How to fix Improper Authentication? Upgrade `jsonwebtoken` to version 9.0.0 or higher.	<9.0.0

Vulnerability

Vulnerable Version

Use of a Broken or Risky Cryptographic Algorithm

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm such that the library can be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm.

How to fix Use of a Broken or Risky Cryptographic Algorithm?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0

Improper Restriction of Security Token Assignment

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the secretOrPublicKey argument due to misconfigurations of the key retrieval function jwt.verify(). Exploiting this vulnerability might result in incorrect verification of forged tokens when tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm.

Note: This vulnerability affects your application if it supports the usage of both symmetric and asymmetric keys in jwt.verify() implementation with the same key retrieval function.

How to fix Improper Restriction of Security Token Assignment?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0

Improper Authentication

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Improper Authentication such that the lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification.

How to fix Improper Authentication?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0

jsonwebtoken@8.5.1@8.5.1@8.5.1@8.5.1 vulnerabilities

licenses detected

Direct Vulnerabilities

How to fix?