-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing key-algorithm validation in both signing and verification processes. The commit e1fa9dcc added validateAsymmetricKey.js and integrated it into sign.js/verify.js to enforce algorithm-key compatibility. Prior to this, the library didn't validate if RSA/EC keys were being used with HS256 (symmetric) algorithms, enabling algorithm substitution attacks. The vulnerable functions are the core sign/verify entry points that lacked these validations in <=8.5.1, as shown by the patch adding validation checks to these exact functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jsonwebtoken | npm | <= 8.5.1 | 9.0.0 |
Ongoing coverage of React2Shell