Hex/jose CVE-2026-65628: unknown, EPSS 0.14%
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
Action: Upgrade jose to 1.11.13 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5.0 | 1.11.13 | - |
Fixed versions
| 1.11.13 |
Sources
- osv: EEF-CVE-2026-65628
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
- https://cna.erlef.org/cves/CVE-2026-65628.html
- https://github.com/potatosalad/erlang-jose/commit/7b80b9f55b9898e1a6901ce136061b241b021d7c
- https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a
- https://hex.pm/packages/jose
CVE-2026-65628 · published · modified · JSON