CVE-2015-9235: Verification Bypass in jsonwebtoken
7.5
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.9723%
CWE
Published
10/9/2018
Updated
1/9/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
jsonwebtoken | npm | < 4.2.2 | 4.2.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from the verify function's lack of algorithm validation prior to the patch. The commit diff shows the addition of critical checks: 1) auto-populating options.algorithms
based on key type (asymmetric vs symmetric), and 2) validating the header's alg
against this whitelist. Before this fix, the function blindly trusted the attacker-controlled alg
header field, allowing algorithm confusion attacks. The NVD description explicitly references this weakness in algorithm validation (CWE-20), and the commit directly modifies the verify function to address it.