Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

jsonwebtoken

Ecosystem:
npm
Package URL:
pkg:npm/jsonwebtoken
Total PRs:
1,676 Dependabot PRs
Latest PR:
7 days ago
Unique Repositories:
1,125 repositories
Unique Repos (30 days):
16 repositories
Security Advisories
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
GHSA-qwph-4952-7xr6 CVE-2022-23540 MODERATE published over 3 years ago • updated 25 days ago
# Overview In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can ...
Verification Bypass in jsonwebtoken
GHSA-c7hr-j4mj-j2w6 CVE-2015-9235 CRITICAL published over 7 years ago • updated 1 day ago
Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT al...
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
GHSA-hjrf-2m68-5959 CVE-2022-23541 MODERATE published over 3 years ago • updated 2 months ago
# Overview Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referrin...
jsonwebtoken unrestricted key type could lead to legacy keys usage
GHSA-8cf7-32gw-wr33 CVE-2022-23539 HIGH published over 3 years ago • updated 15 days ago
# Overview Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verificat...
Recent PRs (filtered by: Removal PRs )
RSS Feed Clear filter
deps(deps): bump jsonwebtoken and next

lukasz-karolewski/wireguard-manager #26

removed Removal PR
Closed 25 days ago 1 comment
lukasz-karolewski
Bump jsonwebtoken and serverless-offline in /api

fernandooj/codegas #102

removed Removal PR
Open 9 months ago 1 comment
fernandooj
Bump jsonwebtoken and web-ext

Lotti/watson-assistant-widget-preview #20

removed Removal PR
Merged 11 months ago
Lotti
Bump jsonwebtoken and web-ext

Lotti/verse-timeoff-counter #27

removed Removal PR
Merged 11 months ago
Lotti
Bump jsonwebtoken and detox-expo-helpers

STMX2023/dams-geo-sdk-deploy #2

removed Removal PR
Closed 11 months ago 1 comment
STMX2023
Bump jsonwebtoken and netlify-cli

q1blue/Engineer #5

removed Removal PR
Open about 1 year ago 1 comment
q1blue
Bump jsonwebtoken and netlify-cli

bryanmikaelian/netlify-cljs-shadowcljs #7

removed Removal PR
Merged over 2 years ago 4 comments
bryanmikaelian
chore(deps): bump jsonwebtoken and oas-tools in /server

DMGT-TECH/the-usher-server #70

removed Removal PR
Closed almost 3 years ago 1 comment
DMGT-TECH
Bump jsonwebtoken and firebase-tools in /blog

nichelia/blog #20

removed Removal PR
Closed about 3 years ago 1 comment
nichelia
build(deps): bump jsonwebtoken and firebase-tools

xmlking/yeti #675

removed Removal PR
Open over 3 years ago
xmlking
Bump jsonwebtoken and netlify-cli

stebogit/turf-sandbox #38

removed Removal PR
Closed over 3 years ago
stebogit
build(deps): bump jsonwebtoken and serverless-offline

Internet-Society-Belgium/isTrust-API #37

removed Removal PR
Closed over 3 years ago 1 comment
Internet-Society-Belgium
Bump jsonwebtoken and serverless-offline in /test/packages/complex/npm

FormidableLabs/serverless-jetpack #327

removed Removal PR
Closed over 3 years ago
FormidableLabs
Bump jsonwebtoken and next-auth in /omarasti

lsspkk/omarasti #27

removed Removal PR
Closed over 3 years ago 2 comments
lsspkk
Bump jsonwebtoken and serverless-offline

ardeshireshghi/feature-flag #52

removed Removal PR
Closed over 3 years ago 1 comment
ardeshireshghi
Bump jsonwebtoken and next

ivanleomk/portfolio #19

removed Removal PR
Open over 3 years ago
ivanleomk
Bump jsonwebtoken and next

JoaquinBattilana/jb-meli-frontend #219

removed Removal PR
Closed over 3 years ago
JoaquinBattilana
Bump jsonwebtoken and serverless-offline

ellingwood/serverless-stack #34

removed Removal PR
Closed over 3 years ago 1 comment
ellingwood
build(deps): bump jsonwebtoken and serverless-offline

Chinmayamission/CFF #325

removed Removal PR
Closed over 3 years ago 1 comment
Chinmayamission
Bump jsonwebtoken and @adonisjs/auth

milena-rosa/adonisjs-test #15

removed Removal PR
Closed over 3 years ago
milena-rosa
Bump jsonwebtoken and serverless-offline in /test/packages/simple/npm

FormidableLabs/serverless-jetpack #326

removed Removal PR
Closed over 3 years ago 1 comment
FormidableLabs
Bump jsonwebtoken and serverless-offline

xpeppers/xpeppers-academy #16

removed Removal PR
Closed over 3 years ago
xpeppers
Package Details
Name: jsonwebtoken
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/jsonwebtoken
JSON API: View JSON
Security Advisories

4

Active advisories
CRITICAL 1
HIGH 1
MODERATE 2
View All npm Advisories
Package Information
Description:

JSON Web Token implementation (symmetric and asymmetric)

Repository: https://github.com/auth0/node-jsonwebtoken
Homepage: https://github.com/auth0/node-jsonwebtoken#readme
Latest Release: 9.0.2
almost 3 years ago
Dependent Repos: 718,942
Dependent Packages: 21,931
Downloads: 85,224,722
Ranking: Top 0.0429% by dependent repos Top 0.0268% by downloads Top 0.0048% by dependent pkgs
PR Status
Open 762 (45.5%)
Merged 103 (6.1%)
Closed 742 (44.3%)
PR Types
Major 839 (50.1%)
Minor 6 (0.4%)
Patch 735 (43.9%)
Removal 22 (1.3%)