{"action":"Upgrade jsonwebtoken to 10.3.0 or later.","affected":[{"fixed":"10.3.0","introduced":"0"}],"component":"jsonwebtoken","cve_ids":["CVE-2026-25537"],"ecosystem":"crates.io","epss":0.00496,"exploited":false,"fixed_versions":["10.3.0"],"ghsa_id":"GHSA-h395-gr6q-cpjc","id":"tcs_01M5KF087JFJD88E1Q0N7Q8MW6","modified_at":"2026-09-10T03:50:35.169824826Z","published_at":"2026-02-03T18:47:40Z","references":["https://osv.dev/vulnerability/GHSA-h395-gr6q-cpjc","https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc","https://nvd.nist.gov/vuln/detail/CVE-2026-25537","https://github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01","https://github.com/Keats/jsonwebtoken"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h395-gr6q-cpjc","url":"https://osv.dev/vulnerability/GHSA-h395-gr6q-cpjc"},{"source":"nvd","source_id":"CVE-2026-25537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25537"}],"summary":"jsonwebtoken has Type Confusion that leads to potential authorization bypass"}