Skip to content
OpenAdvisories

Package · npm

jws

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2025-65945 Public exploit

    auth0/node-jws improper HMAC signature verification vulnerability

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

    auth0 node-jws jws npm
  • High 8.7
    CVE-2016-1000223

    Forgeable Public/Private Tokens in jws

    Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use…

    jws npm