Skip to content
OpenAdvisories

Package · npm

node-jose

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2023-25653

    Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

    node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a De…

    Cisco node-jose node-jose Network devices npm
  • High 7.5
    CVE-2018-0114 Public exploit EPSS 43%

    Cisco node-jose improper validation of JWT signature

    A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (J…

    node-jose npm