{"action":"Upgrade jsonwebtoken to 4.2.2 or later.","affected":[{"fixed":"4.2.2","introduced":"0"}],"component":"jsonwebtoken","cve_ids":["CVE-2015-9235"],"ecosystem":"npm","epss":0.08524,"exploited":false,"fixed_versions":["4.2.2"],"ghsa_id":"GHSA-c7hr-j4mj-j2w6","id":"tcs_01M5KFJ2S3EFJ1MWKMKD2V629P","modified_at":"2026-09-10T03:48:15.346337398Z","published_at":"2018-10-09T00:38:30Z","references":["https://osv.dev/vulnerability/GHSA-c7hr-j4mj-j2w6","https://nvd.nist.gov/vuln/detail/CVE-2015-9235","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries","https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","https://www.npmjs.com/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-c7hr-j4mj-j2w6","url":"https://osv.dev/vulnerability/GHSA-c7hr-j4mj-j2w6"}],"summary":"Verification Bypass in jsonwebtoken"}