Node-jsonwebtoken (Auth0) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2022-12-23. Vendor: Auth0.

CVEs of Node-jsonwebtoken

• CVE-2022-23539 - CVSS 8.1 (high), 2022-12-23: Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA…
• CVE-2022-23540 - CVSS 7.6 (high), 2022-12-22: In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to…
• CVE-2022-23541 - CVSS 6.3 (medium), 2022-12-22: jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented…