PT-2020-7931 · Jws · Jws

Published 2020-09-01 · Updated 2026-06-04 · CVE-2016-1000223

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: jws versions prior to 3.0.0

Description: The issue allows a malicious actor to modify the contents of a JWT while still passing verification, potentially leading to a complete authentication bypass. This can be achieved by exploiting the behavior of the jws package that allows users to select the algorithm for verifying a provided JWT.

Recommendations: Update to version 3.0.0 or later.

Fix

Related Identifiers

CVE-2016-1000223

GHSA-GJCW-V447-2W7Q

Affected Products

Jws

References · 8

• https://osv.dev/vulnerability/GHSA-gjcw-v447-2w7q · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2016-1000223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000223 · Security Note
• https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e · Note
• https://github.com/brianloveswords/node-jws · Note
• https://npmjs.com/advisories/88 · Note
• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · Note
• https://snyk.io/vuln/npm:jws:20160726 · Note