`jsonwebtoken`

Ecosystem:
npm

Package URL:
pkg:npm/jsonwebtoken

Total PRs:
1,676 Dependabot PRs

Latest PR:
7 days ago

Unique Repositories:
1,125 repositories

Unique Repos (30 days):
16 repositories

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

GHSA-qwph-4952-7xr6 CVE-2022-23540 MODERATE published over 3 years ago • updated 25 days ago

# Overview In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can ...

Verification Bypass in jsonwebtoken

GHSA-c7hr-j4mj-j2w6 CVE-2015-9235 CRITICAL published over 7 years ago • updated 1 day ago

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT al...

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

GHSA-hjrf-2m68-5959 CVE-2022-23541 MODERATE published over 3 years ago • updated 2 months ago

# Overview Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referrin...

0.4.0 → 9.0.3 Major PR

Closed 7 days ago 3 comments

build(deps): bump jsonwebtoken from 9.0.0 to 9.0.3

astroboy-alt/Owasp-CI-CD-lab #46

9.0.0 → 9.0.3 Patch PR

Closed 8 days ago 2 comments

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 29 updates

WomB0ComB0/js-testing #11

9.0.2 → 9.0.3 Patch PR

Closed 15 days ago 1 comment

chore(deps): bump the minor-and-patch group across 1 directory with 58 updates

joeldblanco/campus-lingowow #43

9.0.2 → 9.0.3 Patch PR

Open 15 days ago 1 comment

build(deps): bump the simple group across 1 directory with 60 updates

sjwiesman/materialize #540

9.0.2 → 9.0.3 Patch PR

Open 15 days ago 1 comment

Bump the minor-patch group with 8 updates

424635328/SurveyKit #341

9.0.2 → 9.0.3 Patch PR

Closed 17 days ago 4 comments

Bump the minor-patch group with 8 updates

424635328/SurveyKit #338

9.0.2 → 9.0.3 Patch PR

Closed 18 days ago 4 comments

chore(deps): bump the patch-updates group across 1 directory with 77 updates

dculussoftwares/dculus-forms #48

9.0.2 → 9.0.3 Patch PR

Closed 19 days ago 1 comment

Bump the minor-patch group with 8 updates

424635328/SurveyKit #335

9.0.2 → 9.0.3 Patch PR

Closed 20 days ago 4 comments

Bump the minor-patch group with 8 updates

424635328/SurveyKit #333

9.0.2 → 9.0.3 Patch PR

Closed 21 days ago 4 comments

Bump the production-dependencies group across 1 directory with 44 updates

abduvali-web/ok #16

9.0.2 → 9.0.3 Patch PR

Open 21 days ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 53 updates

credebl/studio #1300

9.0.2 → 9.0.3 Patch PR

Open 22 days ago 1 comment

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #9

8.5.1 → 9.0.3 Major PR

Closed 22 days ago 1 comment

chore(deps): bump the npm-all group with 67 updates

MatHoyer/hypertube #217

9.0.2 → 9.0.3 Patch PR

Closed 22 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

Gaveen711/xaujournal #8

8.5.1 → 9.0.3 Major PR

Closed 23 days ago 2 comments

chore(deps)(deps): bump the backend-minor-patch group across 1 directory with 34 updates

SiraGPT-ORg/siraGPT #80

9.0.2 → 9.0.3 Patch PR

Open 24 days ago 1 comment

chore(deps)(deps): bump the backend-minor-patch group across 1 directory with 33 updates

SiraGPT-ORg/siraGPT #79

9.0.2 → 9.0.3 Patch PR

Open 24 days ago 1 comment

Bump the minor-patch group with 8 updates

424635328/SurveyKit #330

9.0.2 → 9.0.3 Patch PR

Closed 24 days ago 4 comments

deps(deps): bump jsonwebtoken and next

lukasz-karolewski/wireguard-manager #26

removed Removal PR

Closed 25 days ago 1 comment

chore(deps): bump the patch-updates group with 44 updates

dculussoftwares/dculus-forms #21

9.0.2 → 9.0.3 Patch PR

Closed 26 days ago 1 comment

Bump the minor-patch group with 7 updates

424635328/SurveyKit #324

9.0.2 → 9.0.3 Patch PR

Closed 27 days ago 4 comments

chore(deps): bump the minor-and-patch group across 1 directory with 54 updates

yohandry10/erp #69

9.0.2 → 9.0.3 Patch PR

Open 28 days ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 94 updates

credebl/studio #1295

9.0.2 → 9.0.3 Patch PR

Open 29 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 31 updates

aravindvnair99/Spot-the-Hole #747

8.5.1 → 9.0.3 Major PR

Open about 1 month ago 3 comments

Bump the npm_and_yarn group across 1 directory with 6 updates

nicdux/juice-shop-mdc #34

0.4.0 → 9.0.0 Major PR

Closed about 1 month ago 3 comments

Bump the npm_and_yarn group across 2 directories with 26 updates

OfficeDev/Microsoft-Teams-Samples #2132

8.5.1 → 9.0.3 Major PR

Closed about 1 month ago 1 comment

deps: bump the minor-patch group across 1 directory with 16 updates

940smiley/RecoveredTreasuresTX.shop-Website-files #56

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 1 comment

chore(deps): bump the minor-and-patch group across 1 directory with 66 updates

raimp001/basehealth-core #50

9.0.2 → 9.0.3 Patch PR

Open about 1 month ago 2 comments

deps(deps): bump the major group with 56 updates

SriKaratalapu/juice-shop-krishna #13

0.4.0 → 9.0.3 Major PR

Closed about 1 month ago 3 comments

Bump jsonwebtoken from 9.0.2 to 9.0.3 in /server

hitesh-kumar123/Travel-Plans- #4

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 2 comments

chore(deps): bump the npm-minor-patch group across 1 directory with 8 updates

voiceyBill/voiceyBill-server #21

9.0.2 → 9.0.3 Patch PR

Open about 1 month ago 1 comment

build(deps): bump the simple group across 1 directory with 56 updates

sjwiesman/materialize #523

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 2 comments

Bump the npm_and_yarn group across 1 directory with 28 updates

Cyptopimpinainteazy/DEXTOOLSassets #1

8.5.1 → 9.0.3 Major PR

Open about 1 month ago 1 comment

Bump jsonwebtoken and passport-jwt

lkarow/shop-api #15

8.5.1 → 9.0.0 Major PR

Closed about 1 month ago 1 comment

chore(backend-deps)(deps): bump the backend-minor-and-patch group in /backend with 12 updates

openclaw743/PixDiary #25

9.0.2 → 9.0.3 Patch PR

Open about 1 month ago 1 comment

deps(backend)(deps): bump jsonwebtoken from 9.0.2 to 9.0.3 in /backend

mmfellows/wealth-navigator #2

9.0.2 → 9.0.3 Patch PR

Open about 1 month ago 2 comments

chore(deps): bump the prod-patch-updates group across 1 directory with 25 updates

CBalaa/Termix #13

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 1 comment

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #6

8.5.1 → 9.0.3 Major PR

Closed about 1 month ago 1 comment

Bump the npm_and_yarn group across 1 directory with 25 updates

fharisorg/fhrass #1

8.5.1 → 9.0.0 Major PR

Open about 1 month ago 2 comments

Bump the npm-dependencies group across 1 directory with 47 updates

senoldogann/copilot-mobile #78

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 1 comment

chore(deps): bump the non-breaking-changes group with 82 updates

doweinide/vue3-vben3-NexusChat #11

9.0.2 → 9.0.3 Patch PR

Open about 1 month ago 18 comments

Bump the npm_and_yarn group across 1 directory with 9 updates

tmfurr97-prog/inked-ai-power-house #5

8.5.1 → 9.0.3 Major PR

Closed about 2 months ago 2 comments

Bump the minor-patch group with 7 updates

424635328/SurveyKit #293

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 4 comments

chore(deps): bump the non-breaking-changes group across 1 directory with 70 updates

wf1120/kuaidi-admin #11

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 40 updates

FreedoomForm/debdi #5

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 2 comments

Bump the npm-dependencies group across 1 directory with 45 updates

senoldogann/copilot-mobile #38

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump jsonwebtoken from 9.0.2 to 9.0.3

knocklabs/javascript #977

9.0.2 → 9.0.3 Patch PR

Open about 2 months ago 2 comments

Bump the minor-patch group with 7 updates

424635328/SurveyKit #289

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 4 comments

deps(back): bump the backend-deps group in /allgrow-backend with 13 updates

yatinsingh2007/VintiCode #7

9.0.2 → 9.0.3 Patch PR

Open about 2 months ago 2 comments

build(deps): bump the all-dependencies group with 33 updates

jatinkumarsingh/Doctor_Appointment #1

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Package Details

Name:	`jsonwebtoken`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/jsonwebtoken`
JSON API:	View JSON

Security Advisories

4

Active advisories

CRITICAL 1

HIGH 1

MODERATE 2

View All npm Advisories

Package Information

Description:

JSON Web Token implementation (symmetric and asymmetric)

Repository:	https://github.com/auth0/node-jsonwebtoken
Homepage:	https://github.com/auth0/node-jsonwebtoken#readme
Latest Release:	`9.0.2` almost 3 years ago
Dependent Repos:	718,942
Dependent Packages:	21,931
Downloads:	85,224,722
Ranking:	Top 0.0429% by dependent repos Top 0.0268% by downloads Top 0.0048% by dependent pkgs

PR Status

Open 762 (45.5%)

Merged 103 (6.1%)

Closed 742 (44.3%)

PR Types

Major 839 (50.1%)

Minor 6 (0.4%)

Patch 735 (43.9%)

Removal 22 (1.3%)

jsonwebtoken

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Verification Bypass in jsonwebtoken

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

jsonwebtoken unrestricted key type could lead to legacy keys usage

Recent PRs

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`jsonwebtoken`