Advisory Weakness Curation

Invalid Curve Attack in node-jose Affected versions of `node-jose` are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used. Proof of Concept https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae ## Recommendation Update to version 0.9.3 or later.

Inadequate Encryption Strength node-jose is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.