https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:25:32 +0000 https://vulnerability.circl.lu/vuln/ghsa-869p-cjfg-cm3x <p><strong>Affected:</strong> npm: jws</p> <p>### Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.</p> <p>### Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions:</p> <p>1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions &lt;=3.2.2 || 4.0.0 2. Application uses the jws.createVerify() function for HMAC algorithms 3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines</p> <p>You are NOT affected by this vulnerability if you meet any of the following preconditions: 1. Application uses the jws.verify() interface (note: `auth0/node-jsonwebtoken` users fall into this category and are therefore NOT affected by this vulnerability) 2. Application uses only asymmetric algorithms (e.g. RS256) 3. Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines</p> <p>### Fix Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1</p> <p>### Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.</p> <p><strong>Affected:</strong> npm: jws</p> <p>### Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.</p> <p>### Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions:</p> <p>1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions &lt;=3.2.2 || 4.0.0 2. Application uses the jws.createVerify() function for HMAC algorithms 3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines</p> <p>You are NOT affected by this vulnerability if you meet any of the following preconditions: 1. Application uses the jws.verify() interface (note: `auth0/node-jsonwebtoken` users fall into this category and are therefore NOT affected by this vulnerability) 2. Application uses only asymmetric algorithms (e.g. RS256) 3. Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines</p> <p>### Fix Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1</p> <p>### Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.</p> https://vulnerability.circl.lu/vuln/ghsa-869p-cjfg-cm3x