Repository navigation
Security: web-token/jwt-framework
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracleGHSA-5739-39v2-5754 published
Jun 6, 2026 by SpomkyModerate -
Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryptionGHSA-6vvh-pxr4-25r7 published
Jun 6, 2026 by SpomkyModerate -
PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of serviceGHSA-3prj-6hqw-cm82 published
Jun 6, 2026 by SpomkyHigh -
JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacksGHSA-jc38-x7x8-2xc8 published
Jun 6, 2026 by SpomkyHigh