Skip to content
OpenAdvisories

Package · npm

jose-browser-runtime

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2022-36083

    JOSE vulnerable to resource exhaustion via specifically crafted JWE

    JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter …

    panva jose jose node-jose Debian Ubuntu npm
  • Medium 5.9
    CVE-2021-29444

    Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

    jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and…

    panva jose jose-browser-runtime npm