CVE-2025-59936
1 advisory.
npm/get-jwks CVE-2025-59936: critical 9.4, EPSS 0.40%
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Action: Upgrade get-jwks to 11.0.2 or later.
npm i get-jwks@11.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 11.0.2 | - |
Fixed versions
| 11.0.2 |
Sources
- osv: GHSA-qc2q-qhf3-235m
- https://github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m
- https://nvd.nist.gov/vuln/detail/CVE-2025-59936
- https://github.com/nearform/get-jwks/commit/1706a177a80a1759fe68e3339dc5a219ce03ddb9
- https://github.com/nearform/get-jwks
CVE-2025-59936 · published · modified · JSON