{
"id": "GHSA-c7hr-j4mj-j2w6",
"aliases": [
"CVE-2015-9235"
],
"details": "Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.2.2 or later.",
"summary": "Verification Bypass in jsonwebtoken",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.2"
}
]
}
],
"package": {
"name": "jsonwebtoken",
"ecosystem": "npm"
}
}
],
"modified": "2020-08-31T18:07:57Z",
"severity": [],
"published": "2018-10-09T00:38:30Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9235",
"type": "ADVISORY"
},
{
"url": "https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687",
"type": "WEB"
},
{
"url": "https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries",
"type": "WEB"
},
{
"url": "https://github.com/advisories/GHSA-c7hr-j4mj-j2w6",
"type": "ADVISORY"
},
{
"url": "https://www.npmjs.com/advisories/17",
"type": "WEB"
},
{
"url": "https://www.timmclean.net/2015/02/25/jwt-alg-none.html",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:30:27Z"
}
}