{"action":"Upgrade jwe to 1.1.1 or later.","affected":[{"fixed":"1.1.1","introduced":"0"}],"component":"jwe","cve_ids":["CVE-2025-54887"],"ecosystem":"RubyGems","epss":0.00268,"exploited":false,"fixed_versions":["1.1.1"],"ghsa_id":"GHSA-c7p4-hx26-pr73","id":"tcs_01M5KEJNMXQ3NHH9XXQ1GP0JNN","modified_at":"2025-08-08T19:39:11.576065Z","published_at":"2025-08-07T20:55:35Z","references":["https://osv.dev/vulnerability/GHSA-c7p4-hx26-pr73","https://github.com/jwt/ruby-jwe/security/advisories/GHSA-c7p4-hx26-pr73","https://nvd.nist.gov/vuln/detail/CVE-2025-54887","https://github.com/jwt/ruby-jwe/commit/1e719d79ba3d7aadaa39a2f08c25df077a0f9ff1","https://github.com/jwt/ruby-jwe","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jwe/CVE-2025-54887.yml"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-c7p4-hx26-pr73","url":"https://osv.dev/vulnerability/GHSA-c7p4-hx26-pr73"}],"summary":"JWE is missing AES-GCM authentication tag validation in encrypted JWE"}