Is jsonwebtoken safe ? 5 known vulnerabilities, worst severity CRITICAL.
// reach 16 direct dependencies
6 carry known advisories, worst CRITICAL
296 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss severity band, no base score published
epss chance of exploitation in 30 days, 95th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-c7hr-j4mj-j2w6, the advisory selected below
// 5 advisories GHSA-c7hr-j4mj-j2w6 Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. CRIT GHSA-8cf7-32gw-wr33 Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. HIGH GHSA-27h2-hvpr-p74q For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE). HIGH GHSA-qwph-4952-7xr6 In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. MODE GHSA-hjrf-2m68-5959 Versions <=8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the secretOrPublicKey argument from the readme link) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification than the one that was used to sign the tokens. Specifically, tokens sig MODE Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.
// recommendation Update to version 4.2.2 or later.
Checked 2026-11-06 at 21:29 UTC. The most recent advisory here was published 2022-12-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page