Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT.
Full advisory text at GitHub advisory or NVD.
npm package report
Is jwt-simple safe?
jwt-simple (npm) has 2 known vulnerabilities, the worst rated CRITICAL. Upgrade to 0.5.3 or later to clear all of them. No malicious-package signal is recorded.
// reach
0 direct dependencies
none carry a known advisory
8 packages depend on it
an advisory here reaches each of them
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
9.0
critical
severity band, no base score published
epss
4.7%
medium
chance of exploitation in 30 days, 92nd percentile of all CVEs
xyz score
4.7
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-vgrx-w6rg-8fqf, the advisory selected below
// 2 advisories
Is jwt-simple safe to install?
CyberXYZ does not call a package safe in absolute terms. It records 2 known vulnerabilities for jwt-simple (npm), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does jwt-simple have known vulnerabilities?
Yes. CyberXYZ records 2 known vulnerabilities for jwt-simple (npm), the worst rated CRITICAL. They are GHSA-vgrx-w6rg-8fqf, GHSA-8v5f-hp78-jgxq.
Which version of jwt-simple should I use?
0.5.3 or later clears every advisory recorded for jwt-simple (npm). Check the release you pick before installing it.
How do I check jwt-simple before installing?
Search jwt-simple in CyberXYZ Check at https://cyberxyz.io/check?q=jwt-simple. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 12:39 UTC. The most recent advisory here was published 2019-06-06. Updated continuously from NVD, GHSA, OSV and CNA feeds.