Search for packages
| purl | pkg:npm/jsonwebtoken@1.3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2293-mydj-7bg4
Aliases: CVE-2022-23540 GHSA-qwph-4952-7xr6 |
jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass |
Affected by 0 other vulnerabilities. |
|
VCID-54h7-2gp7-1yb9
Aliases: GMS-2015-4 |
JWT Verification bypass with "none" algorithm It is possible for an attacker to create his own signed token with any payload he wants and have it considered valid using the "none" algorithm. |
Affected by 3 other vulnerabilities. |
|
VCID-56kh-94nv-5khy
Aliases: CVE-2022-23539 GHSA-8cf7-32gw-wr33 |
jsonwebtoken: Unrestricted key type could lead to legacy keys usagen |
Affected by 0 other vulnerabilities. |
|
VCID-5n9u-avux-mbhx
Aliases: CVE-2015-9235 GHSA-c7hr-j4mj-j2w6 |
Use of a Broken or Risky Cryptographic Algorithm In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family). |
Affected by 3 other vulnerabilities. |
|
VCID-6mrt-me4e-6fh2
Aliases: CVE-2022-23541 GHSA-hjrf-2m68-5959 |
jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T03:20:26.872350+00:00 | GitLab Importer | Affected by | VCID-56kh-94nv-5khy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jsonwebtoken/CVE-2022-23539.yml | 38.6.0 |
| 2026-06-06T03:20:17.883657+00:00 | GitLab Importer | Affected by | VCID-6mrt-me4e-6fh2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jsonwebtoken/CVE-2022-23541.yml | 38.6.0 |
| 2026-06-06T03:20:16.648856+00:00 | GitLab Importer | Affected by | VCID-2293-mydj-7bg4 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jsonwebtoken/CVE-2022-23540.yml | 38.6.0 |
| 2026-06-04T20:14:56.768617+00:00 | GitLab Importer | Affected by | VCID-5n9u-avux-mbhx | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jsonwebtoken/CVE-2015-9235.yml | 38.6.0 |
| 2026-06-04T20:04:46.891723+00:00 | GitLab Importer | Affected by | VCID-54h7-2gp7-1yb9 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/jsonwebtoken/GMS-2015-4.yml | 38.6.0 |