Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-65945 EUVD-2025-201250GHSA-869p-cjfg-cm3x

auth0/node-jws improper HMAC signature verification vulnerability

Published Dec 4, 2025 · Updated Dec 5, 2025 · Assigned by GitHub_M

Vendor: auth0 Product: node-jws Package: jitsucom-jitsu Package: jitsucom-jitsu-console Package: jitsucom-jitsu-rotor Package: jws Package: kubeflow-centraldashboard Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: langfuse-3 Package: langfuse-3-compat Package: langfuse-3-worker Package: renovate Package: saf Package: sqlpad Package: sqlpad-compat Ecosystem: npm Ecosystem: Wolfi

Description

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

Affected products

VendorProductAffectedFixed
auth0 node-jws < 3.2.3, >= 4.0.0, <= 4.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jitsucom-jitsu +2 2.11.0-r10 —
Wolfi rolling kubeflow-centraldashboard 1.10.0-r7 —
Wolfi rolling kubeflow-pipelines +11 2.15.0-r2 —
Wolfi rolling langfuse-3 +2 3.138.0-r0 —
Wolfi rolling renovate 42.39.1-r0 —
Wolfi rolling saf 1.5.2-r0 —
Wolfi rolling sqlpad +1 7.5.7-r4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • jedisct1/CVE-2025-65945-poc ★ 4 · Dec 17, 2025

    PoC for CVE-2025-65945 (Improper Verification of Cryptographic Signature in node-jws)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm jws < 3.2.3 3.2.3 GHSA-869p-cjfg-cm3x
npm jws >= 4.0.0, < 4.0.1 4.0.1 GHSA-869p-cjfg-cm3x

Advisories 2

References