CriticalGHSA-c7hr-j4mj-j2w6CVE-2015-9235
Verification Bypass in jsonwebtoken
Published 9 Oct 2018 · Updated 10 Sept 2026
Affected package
jsonwebtokennpm
- Affected
- <4.2.2
- Fixed in
- 4.2.2
Update to the fixed version for your release line, for example:
npm install jsonwebtoken@4.2.2Details
Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.
Recommendation
Update to version 4.2.2 or later.
Is GHSA-c7hr-j4mj-j2w6 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected jsonwebtoken, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2015-9235
- Linkgithub.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
- Linkauth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
- Advisorygithub.com/advisories/GHSA-c7hr-j4mj-j2w6
- Linkwww.npmjs.com/advisories/17
- Linkwww.timmclean.net/2015/02/25/jwt-alg-none.html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.