Skip to content
OpenAdvisories

Package · npm

get-jwks

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.4
    CVE-2025-59936

    get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

    get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is …

    nearform get-jwks get-jwks npm