PT-2022-16059 · Unknown · Jsonwebtoken

Julienwoll · Published 2022-12-22 · Updated 2026-06-04 · CVE-2022-23539

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions <=8.5.1

Description The jsonwebtoken library could be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm. Users are affected if they use an algorithm and key type combination other than those listed as unaffected. The issue has been fixed in version 9.0.0, which validates asymmetric key type and algorithm combinations.

Recommendations Update to version 9.0.0 to fix the issue. After updating, if you still intend to use invalid key type/algorithm combinations, set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2022-23539

GHSA-8CF7-32GW-WR33

Affected Products

Jsonwebtoken

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23539.json · Exploit
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3 · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2022-23539 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23539 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8cf7-32gw-wr33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23539 · Security Note
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33 · Note
• https://github.com/auth0/node-jsonwebtoken · Note
• https://security.netapp.com/advisory/ntap-20240621-0007 · Note
• https://t.me/cibsecurity/55224 · Telegram Post