Kurz gesagt
- CVE-2025-65945 ist eine Schwachstelle (HOCH (CVSS 7.5)) in node-jws (auth0), jws.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.21%, höher als bei 12.0% aller Schwachstellen.
- Abhilfe: auf 3.2.3, 4.0.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| node-jws | = 4.0.0< 3.2.3
| 3.2.3
|
| jws npm | ≥ 4.0.0, < 4.0.1< 3.2.3
| 4.0.13.2.3
|
Description
Overview
An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.
Am I Affected?
You are affected by this vulnerability if you meet all of the following preconditions:
- Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0
- Application uses the jws.createVerify() function for HMAC algorithms
- Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
You are NOT affected by this vulnerability if you meet any of the following preconditions:
- Application uses the jws.verify() interface (note:
auth0/node-jsonwebtoken users fall into this category and are therefore NOT affected by this vulnerability)
- Application uses only asymmetric algorithms (e.g. RS256)
- Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
Fix
Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1
Acknowledgement
Okta would like to thank Félix Charette for discovering this vulnerability.
NVD description
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free