{"action":"Upgrade jose to 1.28.1 or later.","affected":[{"fixed":"1.28.1","introduced":"1.0.0"},{"fixed":"2.0.5","introduced":"2.0.0"},{"fixed":"3.11.4","introduced":"3.0.0"}],"component":"jose","cve_ids":["CVE-2021-29443"],"ecosystem":"npm","epss":0.01167,"exploited":false,"fixed_versions":["1.28.1","2.0.5","3.11.4"],"ghsa_id":"GHSA-58f5-hfqc-jgch","id":"tcs_01M5KF32KHWESPCNB158FQC6Z6","modified_at":"2026-07-08T06:27:54.450991309Z","published_at":"2021-04-19T14:57:22Z","references":["https://osv.dev/vulnerability/GHSA-58f5-hfqc-jgch","https://github.com/panva/jose/security/advisories/GHSA-58f5-hfqc-jgch","https://nvd.nist.gov/vuln/detail/CVE-2021-29443","https://www.npmjs.com/package/jose"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-58f5-hfqc-jgch","url":"https://osv.dev/vulnerability/GHSA-58f5-hfqc-jgch"}],"summary":"Padding Oracle Attack due to Observable Timing Discrepancy in jose"}