GCVE - cpe:2.3:a:jwt-simple_project:jwt-simple:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jwt-simple_project:jwt-simple:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Jwt Simple Project (`1b6d0f3c-bc79-5b9f-8103-f51465ad8f94`)
Product	Jwt Simple (`199ed8cf-2ff5-57a3-88f4-594e395777b5`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-10555`	vulnerable	2026-06-08 05:07:25.312938	Details available Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants. Published: 2018-05-31T20:00:00.000Z Updated: 2024-09-16T16:38:09.923Z Open on db.gcve.eu Reference links https://nodesecurity.io/advisories/87 https://github.com/hokaccha/node-jwt-simple/pull/14 https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ https://github.com/hokaccha/node-jwt-simple/pull/16	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.