-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jsonwebtoken | npm | <= 8.5.1 | 9.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation in the jwt.verify function's handling of the secretOrPublicKey parameter. The commit diff shows critical security checks were added in verify.js (via validateAsymmetricKey) to enforce algorithm-key type alignment. Prior to these patches, attackers could manipulate key parameters to trigger insecure code paths. The direct modification of verify.js in the security fix and CVE description explicitly implicate this function.
A Semantic Attack on Google Gemini - Read the Latest Research