Tóm tắt nhanh
- CVE-2025-65945 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng node-jws (auth0), jws.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.21%, cao hơn 12.0% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 3.2.3, 4.0.1 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| node-jws | = 4.0.0< 3.2.3
| 3.2.3
|
| jws npm | ≥ 4.0.0, < 4.0.1< 3.2.3
| 4.0.13.2.3
|
Mô tả
Overview
An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.
Am I Affected?
You are affected by this vulnerability if you meet all of the following preconditions:
- Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0
- Application uses the jws.createVerify() function for HMAC algorithms
- Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
You are NOT affected by this vulnerability if you meet any of the following preconditions:
- Application uses the jws.verify() interface (note:
auth0/node-jsonwebtoken users fall into this category and are therefore NOT affected by this vulnerability)
- Application uses only asymmetric algorithms (e.g. RS256)
- Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
Fix
Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1
Acknowledgement
Okta would like to thank Félix Charette for discovering this vulnerability.
Mô tả của NVD
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí