Homepage
About Snyk

jsonwebtoken@5.5.3 vulnerabilities

JSON Web Token implementation (symmetric and asymmetric)

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the jsonwebtoken package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Use of a Broken or Risky Cryptographic Algorithm

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm such that the library can be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm.

How to fix Use of a Broken or Risky Cryptographic Algorithm?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0
  • M
Improper Restriction of Security Token Assignment

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the secretOrPublicKey argument due to misconfigurations of the key retrieval function jwt.verify(). Exploiting this vulnerability might result in incorrect verification of forged tokens when tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm.

Note: This vulnerability affects your application if it supports the usage of both symmetric and asymmetric keys in jwt.verify() implementation with the same key retrieval function.

How to fix Improper Restriction of Security Token Assignment?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0
  • M
Improper Authentication

jsonwebtoken is a JSON Web Token implementation (symmetric and asymmetric)

Affected versions of this package are vulnerable to Improper Authentication such that the lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification.

How to fix Improper Authentication?

Upgrade jsonwebtoken to version 9.0.0 or higher.

<9.0.0
Go back to all versions of this package