GHSA-27h2-hvpr-p74q

Source

https://github.com/advisories/GHSA-27h2-hvpr-p74q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-27h2-hvpr-p74q/GHSA-27h2-hvpr-p74q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-27h2-hvpr-p74q

Aliases

CVE-2022-23529

Withdrawn

2023-01-27T21:51:55Z

Published

2022-12-22T03:31:28Z

Modified

2026-09-10T03:49:50Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator

Summary

jsonwebtoken has insecure input validation in jwt.verify function

Details

Overview

For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE).

Am I affected?

This security issue is a concern when the jsonwebtoken library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the jwt.verify() on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.

How do I fix it?

Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.

Database specific

{
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-22T03:31:28Z",
    "nvd_published_at": "2022-12-21T21:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

npm / jsonwebtoken

Package

Name: jsonwebtoken; View open source insights on deps.dev
Purl: pkg:npm/jsonwebtoken

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.0

Database specific

last_known_affected_version_range

"<= 8.5.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-27h2-hvpr-p74q/GHSA-27h2-hvpr-p74q.json"