{"action":"Upgrade jwt-simple to 0.3.1 or later.","affected":[{"fixed":"0.3.1","introduced":"0"}],"component":"jwt-simple","cve_ids":["CVE-2016-10555"],"ecosystem":"npm","epss":0.04733,"exploited":false,"fixed_versions":["0.3.1"],"ghsa_id":"GHSA-vgrx-w6rg-8fqf","id":"tcs_01M5KGBWKCNQPNBBB21GG0M5PE","modified_at":"2023-11-08T03:58:12.325695Z","published_at":"2018-11-06T23:12:07Z","references":["https://osv.dev/vulnerability/GHSA-vgrx-w6rg-8fqf","https://nvd.nist.gov/vuln/detail/CVE-2016-10555","https://github.com/hokaccha/node-jwt-simple/pull/14","https://github.com/hokaccha/node-jwt-simple/pull/16","https://github.com/hokaccha/node-jwt-simple/commit/957957cfa44474049b4603b293569588ee9ffd97","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries","https://www.npmjs.com/advisories/87"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-vgrx-w6rg-8fqf","url":"https://osv.dev/vulnerability/GHSA-vgrx-w6rg-8fqf"},{"source":"nvd","source_id":"CVE-2016-10555","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10555"}],"summary":"Forgeable Public/Private Tokens in jwt-simple"}