Skip to content
OpenAdvisories

Package · npm

jose-node-cjs-runtime

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose jose-node-esm-runtime jose-node-cjs-runtime Ubuntu npm
  • Medium 5.3
    CVE-2022-36083

    JOSE vulnerable to resource exhaustion via specifically crafted JWE

    JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter …

    panva jose jose jose Debian Ubuntu npm
  • Medium 5.9
    CVE-2021-29446

    Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

    jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification an…

    panva jose-node-cjs-runtime jose-node-cjs-runtime npm