`jsonwebtoken`

Ecosystem:
npm

Package URL:
pkg:npm/jsonwebtoken

Total PRs:
1,676 Dependabot PRs

Latest PR:
7 days ago

Unique Repositories:
1,125 repositories

Unique Repos (30 days):
16 repositories

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

GHSA-qwph-4952-7xr6 CVE-2022-23540 MODERATE published over 3 years ago • updated 25 days ago

# Overview In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can ...

Verification Bypass in jsonwebtoken

GHSA-c7hr-j4mj-j2w6 CVE-2015-9235 CRITICAL published over 7 years ago • updated 1 day ago

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT al...

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

GHSA-hjrf-2m68-5959 CVE-2022-23541 MODERATE published over 3 years ago • updated 2 months ago

# Overview Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referrin...

0.4.0 → 9.0.3 Major PR

Closed 7 days ago 3 comments

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #9

8.5.1 → 9.0.3 Major PR

Closed 22 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

Gaveen711/xaujournal #8

8.5.1 → 9.0.3 Major PR

Closed 23 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 31 updates

aravindvnair99/Spot-the-Hole #747

8.5.1 → 9.0.3 Major PR

Open about 1 month ago 3 comments

Bump the npm_and_yarn group across 1 directory with 6 updates

nicdux/juice-shop-mdc #34

0.4.0 → 9.0.0 Major PR

Closed about 1 month ago 3 comments

Bump the npm_and_yarn group across 2 directories with 26 updates

OfficeDev/Microsoft-Teams-Samples #2132

8.5.1 → 9.0.3 Major PR

Closed about 1 month ago 1 comment

deps(deps): bump the major group with 56 updates

SriKaratalapu/juice-shop-krishna #13

0.4.0 → 9.0.3 Major PR

Closed about 1 month ago 3 comments

Bump the npm_and_yarn group across 1 directory with 28 updates

Cyptopimpinainteazy/DEXTOOLSassets #1

8.5.1 → 9.0.3 Major PR

Open about 1 month ago 1 comment

Bump jsonwebtoken and passport-jwt

lkarow/shop-api #15

8.5.1 → 9.0.0 Major PR

Closed about 1 month ago 1 comment

Bump the npm_and_yarn group across 13 directories with 15 updates

sumonst21/strapi #6

8.5.1 → 9.0.3 Major PR

Closed about 1 month ago 1 comment

Bump the npm_and_yarn group across 1 directory with 25 updates

fharisorg/fhrass #1

8.5.1 → 9.0.0 Major PR

Open about 1 month ago 2 comments

Bump the npm_and_yarn group across 1 directory with 9 updates

tmfurr97-prog/inked-ai-power-house #5

8.5.1 → 9.0.3 Major PR

Closed about 2 months ago 2 comments

Bump jsonwebtoken and firebase-tools

aliz-ai/gdocwiki #38

8.5.1 → 9.0.3 Major PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 29 updates

hoangnam-esign/file-storage #10

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 28 updates

hoangnam-esign/file-storage #8

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 2 directories with 10 updates

3rdBaseWildcat/juice-shop #5

0.4.0 → 9.0.0 Major PR

Open 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates

webdevcom01-cell/agent-studio #41

8.5.1 → 9.0.0 Major PR

Closed 2 months ago 1 comment

Bump jsonwebtoken and firebase-admin in /.firebase/studio-2134942499-abd6c/functions

sikkalmcg/Sikkaind #14

8.5.1 → 9.0.3 Major PR

Closed 2 months ago 1 comment

Bump jsonwebtoken from 0.4.0 to 9.0.0

prajakta444/DevSecOps-Pipeline-Juiceshop #8

0.4.0 → 9.0.0 Major PR

Closed 3 months ago 2 comments

build(deps): bump jsonwebtoken from 8.5.1 to 9.0.3

gobila/Bootcamp-Instalura #214

8.5.1 → 9.0.3 Major PR

Closed 3 months ago 2 comments

Bump the npm_and_yarn group across 2 directories with 23 updates

jcseg-2b/Projet-10-SEGALAT_Jean-Charles #4

8.5.1 → 9.0.0 Major PR

Closed 3 months ago 1 comment

Bump the prod-dependencies group with 10 updates

ilyess9/test #11

8.5.1 → 9.0.3 Major PR

Open 3 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 24 updates

ActiveMemory/ctx #47

0.8.0 → 9.0.3 Major PR

Open 3 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 24 updates

aravindvnair99/Spot-the-Hole #733

8.5.1 → 9.0.3 Major PR

Closed 3 months ago 5 comments

Bump the security-major-updates group across 1 directory with 5 updates

quocle108/test-dependabot3 #4

8.5.1 → 9.0.0 Major PR

Closed 3 months ago 1 comment

build(deps): bump jsonwebtoken from 8.5.0 to 9.0.3 in /app

abengtss-max-org/hoglands-demo-app #14

8.5.0 → 9.0.3 Major PR

Open 3 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

BrandonBarber/juice-shop #12

0.4.0 → 9.0.0 Major PR

Open 3 months ago 2 comments

Bump the npm_and_yarn group across 2 directories with 16 updates

BiancaFSilva/ZombiePlus #7

8.5.1 → 9.0.0 Major PR

Closed 3 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 30 updates

LelandParker/dbgate #15

8.5.1 → 9.0.0 Major PR

Closed 3 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

0tieno/juice-shop #146

0.4.0 → 9.0.0 Major PR

Open 3 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 4 updates

tdupoiron-org/juice-shop #5

0.4.0 → 9.0.0 Major PR

Closed 3 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 5 updates

yoshi-org/juice-shop #31

0.4.0 → 9.0.0 Major PR

Open 3 months ago 2 comments

chore: bump the npm_and_yarn group across 1 directory with 5 updates

github-serrala-trial/juice-shop #416

0.4.0 → 9.0.0 Major PR

Closed 3 months ago 4 comments

chore(deps): bump the npm_and_yarn group across 3 directories with 23 updates

24601/apollo-link #25

8.4.0 → 9.0.3 Major PR

Closed 4 months ago 1 comment

build(deps): bump the npm_and_yarn group across 6 directories with 20 updates

omercnet/n8n #12

8.5.1 → 9.0.0 Major PR

Closed 4 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

nicdux/juice-shop-mdc #23

0.4.0 → 9.0.0 Major PR

Open 4 months ago 3 comments

Bump jsonwebtoken from 0.4.0 to 9.0.0

younes-t-devoteam/juice-shop-younes #1

0.4.0 → 9.0.0 Major PR

Open 4 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 3 directories with 28 updates

24601/apollo-link #17

8.4.0 → 9.0.3 Major PR

Closed 4 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 28 updates

LelandParker/dbgate #6

8.5.1 → 9.0.0 Major PR

Closed 4 months ago 1 comment

Bump jsonwebtoken from 8.5.1 to 9.0.3

ALPHAVIO/WordNook #1811

8.5.1 → 9.0.3 Major PR

Open 4 months ago 1 comment

Bump the npm_and_yarn group across 4 directories with 28 updates

LelandParker/dbgate #3

8.5.1 → 9.0.0 Major PR

Closed 4 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates

Love241982/era-contracts #2

8.5.1 → 9.0.0 Major PR

Closed 4 months ago 1 comment

chore: bump jsonwebtoken from 0.4.0 to 9.0.3

github-serrala-trial/juice-shop #405

0.4.0 → 9.0.3 Major PR

Open 4 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 5 updates

swiftraccoon/jumpinchat #8

8.5.1 → 9.0.3 Major PR

Closed 4 months ago 1 comment

Bump the npm_and_yarn group across 4 directories with 22 updates

vinodkumar-github/Madrid #1

8.5.1 → 9.0.3 Major PR

Open 4 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 22 updates

icemeyer-sudo/projet-02 #1

8.5.1 → 9.0.0 Major PR

Closed 4 months ago 1 comment

build(deps): bump jsonwebtoken from 8.5.1 to 9.0.3

juspay/shooter #14

8.5.1 → 9.0.3 Major PR

Open 4 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates

GlacierEQ/chatGPTBox #1

8.5.1 → 9.0.0 Major PR

Open 5 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 25 updates

trizist/cats-in-paris-backend #11

8.5.1 → 9.0.0 Major PR

Open 5 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 22 updates

Kadir-works/argent-bank #1

8.5.1 → 9.0.0 Major PR

Closed 5 months ago 1 comment

Package Details

Name:	`jsonwebtoken`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/jsonwebtoken`
JSON API:	View JSON

Security Advisories

4

Active advisories

CRITICAL 1

HIGH 1

MODERATE 2

View All npm Advisories

Package Information

Description:

JSON Web Token implementation (symmetric and asymmetric)

Repository:	https://github.com/auth0/node-jsonwebtoken
Homepage:	https://github.com/auth0/node-jsonwebtoken#readme
Latest Release:	`9.0.2` almost 3 years ago
Dependent Repos:	718,942
Dependent Packages:	21,931
Downloads:	85,224,722
Ranking:	Top 0.0429% by dependent repos Top 0.0268% by downloads Top 0.0048% by dependent pkgs

PR Status

Open 762 (45.5%)

Merged 103 (6.1%)

Closed 742 (44.3%)

PR Types

Major 839 (50.1%)

Minor 6 (0.4%)

Patch 735 (43.9%)

Removal 22 (1.3%)

jsonwebtoken

Security Advisories

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Verification Bypass in jsonwebtoken

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

jsonwebtoken unrestricted key type could lead to legacy keys usage

Recent PRs (filtered by: Major PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`jsonwebtoken`