npm/jwt-simple CVE-2016-10555: medium 6.5, EPSS 4.73%
Forgeable Public/Private Tokens in jwt-simple
Action: Upgrade jwt-simple to 0.3.1 or later.
npm i jwt-simple@0.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.1 | - |
Fixed versions
| 0.3.1 |
Sources
- osv: GHSA-vgrx-w6rg-8fqf
- nvd: CVE-2016-10555
- https://github.com/hokaccha/node-jwt-simple/pull/14
- https://github.com/hokaccha/node-jwt-simple/pull/16
- https://github.com/hokaccha/node-jwt-simple/commit/957957cfa44474049b4603b293569588ee9ffd97
- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
- https://www.npmjs.com/advisories/87
CVE-2016-10555 · published · modified · JSON