npm/json-web-token CVE-2023-48238: high 7.5
json-web-token library is vulnerable to a JWT algorithm confusion attack
Action: Upgrade json-web-token to 4.0.0 or later.
npm i json-web-token@4.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.0 | - |
Fixed versions
| 4.0.0 |
Sources
- osv: GHSA-4xw9-cx39-r355
- https://github.com/joaquimserafim/json-web-token/security/advisories/GHSA-4xw9-cx39-r355
- https://nvd.nist.gov/vuln/detail/CVE-2023-48238
- https://github.com/joaquimserafim/json-web-token/commit/b6e56b1346f48432d29133c76b65222ad93956b7
- https://github.com/joaquimserafim/json-web-token
- https://github.com/joaquimserafim/json-web-token/blob/acf6a462471e1b14187eb77414e9161b8b7bff7e/index.js#L86
CVE-2023-48238 · published · modified · JSON