`jsonwebtoken`

Ecosystem:
npm

Package URL:
pkg:npm/jsonwebtoken

Total PRs:
1,677 Dependabot PRs

Latest PR:
10 days ago

Unique Repositories:
1,126 repositories

Unique Repos (30 days):
15 repositories

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

GHSA-qwph-4952-7xr6 CVE-2022-23540 MODERATE published over 3 years ago • updated 27 days ago

# Overview In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can ...

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

GHSA-hjrf-2m68-5959 CVE-2022-23541 MODERATE published over 3 years ago • updated 2 months ago

# Overview Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referrin...

0.4.0 → 9.0.3 Major PR

Closed 10 days ago 3 comments

build(deps): bump jsonwebtoken from 9.0.0 to 9.0.3

astroboy-alt/Owasp-CI-CD-lab #46

9.0.0 → 9.0.3 Patch PR

Closed 10 days ago 2 comments

chore(deps)(deps): bump the minor-and-patch group across 1 directory with 29 updates

WomB0ComB0/js-testing #11

9.0.2 → 9.0.3 Patch PR

Closed 17 days ago 1 comment

Bump the minor-patch group with 8 updates

424635328/SurveyKit #341

9.0.2 → 9.0.3 Patch PR

Closed 19 days ago 4 comments

Bump the minor-patch group with 8 updates

424635328/SurveyKit #338

9.0.2 → 9.0.3 Patch PR

Closed 20 days ago 4 comments

chore(deps): bump the patch-updates group across 1 directory with 77 updates

dculussoftwares/dculus-forms #48

9.0.2 → 9.0.3 Patch PR

Closed 21 days ago 1 comment

Bump the minor-patch group with 8 updates

424635328/SurveyKit #335

9.0.2 → 9.0.3 Patch PR

Closed 22 days ago 4 comments

Bump the minor-patch group with 8 updates

424635328/SurveyKit #333

9.0.2 → 9.0.3 Patch PR

Closed 23 days ago 4 comments

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #9

8.5.1 → 9.0.3 Major PR

Closed 24 days ago 1 comment

chore(deps): bump the npm-all group with 67 updates

MatHoyer/hypertube #217

9.0.2 → 9.0.3 Patch PR

Closed 24 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

Gaveen711/xaujournal #8

8.5.1 → 9.0.3 Major PR

Closed 25 days ago 2 comments

Bump the minor-patch group with 8 updates

424635328/SurveyKit #330

9.0.2 → 9.0.3 Patch PR

Closed 26 days ago 4 comments

deps(deps): bump jsonwebtoken and next

lukasz-karolewski/wireguard-manager #26

removed Removal PR

Closed 27 days ago 1 comment

chore(deps): bump the patch-updates group with 44 updates

dculussoftwares/dculus-forms #21

9.0.2 → 9.0.3 Patch PR

Closed 28 days ago 1 comment

Bump the minor-patch group with 7 updates

424635328/SurveyKit #324

9.0.2 → 9.0.3 Patch PR

Closed 29 days ago 4 comments

Bump the npm_and_yarn group across 1 directory with 6 updates

nicdux/juice-shop-mdc #34

0.4.0 → 9.0.0 Major PR

Closed about 1 month ago 3 comments

Bump the npm_and_yarn group across 2 directories with 26 updates

OfficeDev/Microsoft-Teams-Samples #2132

8.5.1 → 9.0.3 Major PR

Closed about 1 month ago 1 comment

deps: bump the minor-patch group across 1 directory with 16 updates

940smiley/RecoveredTreasuresTX.shop-Website-files #56

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 1 comment

deps(deps): bump the major group with 56 updates

SriKaratalapu/juice-shop-krishna #13

0.4.0 → 9.0.3 Major PR

Closed about 1 month ago 3 comments

Bump jsonwebtoken from 9.0.2 to 9.0.3 in /server

hitesh-kumar123/Travel-Plans- #4

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 2 comments

build(deps): bump the simple group across 1 directory with 56 updates

sjwiesman/materialize #523

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 2 comments

Bump jsonwebtoken and passport-jwt

lkarow/shop-api #15

8.5.1 → 9.0.0 Major PR

Closed about 1 month ago 1 comment

chore(deps): bump the prod-patch-updates group across 1 directory with 25 updates

CBalaa/Termix #13

9.0.2 → 9.0.3 Patch PR

Closed about 1 month ago 1 comment

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #6

8.5.1 → 9.0.3 Major PR

Closed about 2 months ago 1 comment

Bump the npm-dependencies group across 1 directory with 47 updates

senoldogann/copilot-mobile #78

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 9 updates

tmfurr97-prog/inked-ai-power-house #5

8.5.1 → 9.0.3 Major PR

Closed about 2 months ago 2 comments

Bump the minor-patch group with 7 updates

424635328/SurveyKit #293

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 4 comments

chore(deps): bump the non-breaking-changes group across 1 directory with 70 updates

wf1120/kuaidi-admin #11

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 40 updates

FreedoomForm/debdi #5

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 2 comments

Bump the npm-dependencies group across 1 directory with 45 updates

senoldogann/copilot-mobile #38

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Bump the minor-patch group with 7 updates

424635328/SurveyKit #289

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 4 comments

build(deps): bump the all-dependencies group with 33 updates

jatinkumarsingh/Doctor_Appointment #1

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Bump the npm-dependencies group across 1 directory with 44 updates

senoldogann/copilot-mobile #21

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump the npm-dependencies group across 1 directory with 45 updates

senoldogann/copilot-mobile #20

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump the npm-dependencies group across 1 directory with 43 updates

senoldogann/copilot-mobile #19

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Bump the development group with 16 updates

ministryofjustice/hmpps-arns-frontend-components #90

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

build(deps): bump the simple group across 1 directory with 57 updates

MaterializeInc/materialize #36150

9.0.2 → 9.0.3 Patch PR

Closed about 2 months ago 1 comment

Bump the minor-patch group with 7 updates

424635328/SurveyKit #276

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 4 comments

Bump the minor-patch group with 7 updates

424635328/SurveyKit #271

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 4 comments

Bump the npm_and_yarn group across 1 directory with 29 updates

hoangnam-esign/file-storage #10

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 28 updates

hoangnam-esign/file-storage #8

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

chore(deps)(deps): bump the production-dependencies group across 1 directory with 15 updates

levanminhduc/LuongHoaThoNew #17

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 2 comments

build(deps): bump the simple group across 1 directory with 55 updates

MaterializeInc/materialize #35965

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates

webdevcom01-cell/agent-studio #41

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

Bump jsonwebtoken and firebase-admin in /.firebase/studio-2134942499-abd6c/functions

sikkalmcg/Sikkaind #14

8.5.1 → 9.0.3 Major PR

Closed 2 months ago 1 comment

Bump the patch group with 22 updates

PoCOrganization1/firebase-tools #1

9.0.0 → 9.0.3 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the minor-and-patch group across 1 directory with 16 updates

josueguido/TaskFlow-App #94

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 1 comment

Bump the minor-patch group with 7 updates

424635328/SurveyKit #251

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 4 comments

chore(deps): bump jsonwebtoken from 9.0.2 to 9.0.3

kunalsuri/DevNest-vanilla #29

9.0.2 → 9.0.3 Patch PR

Closed 2 months ago 2 comments

Bump jsonwebtoken from 9.0.0 to 9.0.3

matmedrado/allbooks #23

9.0.0 → 9.0.3 Patch PR

Closed 2 months ago 1 comment

Package Details

Name:	`jsonwebtoken`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/jsonwebtoken`
JSON API:	View JSON

Security Advisories

4

Active advisories

CRITICAL 1

HIGH 1

MODERATE 2

View All npm Advisories

Package Information

Description:

JSON Web Token implementation (symmetric and asymmetric)

Repository:	https://github.com/auth0/node-jsonwebtoken
Homepage:	https://github.com/auth0/node-jsonwebtoken#readme
Latest Release:	`9.0.2` almost 3 years ago
Dependent Repos:	718,942
Dependent Packages:	21,931
Downloads:	85,224,722
Ranking:	Top 0.0429% by dependent repos Top 0.0268% by downloads Top 0.0048% by dependent pkgs

PR Status

Open 762 (45.4%)

Merged 103 (6.1%)

Closed 743 (44.3%)

PR Types

Major 840 (50.1%)

Minor 6 (0.4%)

Patch 735 (43.8%)

Removal 22 (1.3%)

jsonwebtoken

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

Verification Bypass in jsonwebtoken

jsonwebtoken unrestricted key type could lead to legacy keys usage

Recent PRs (filtered by: Closed )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`jsonwebtoken`