Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix jsonwebtoken <=8.5.1 security issue #57

Open
Amine27 opened this issue Jan 1, 2023 · 0 comments
Open

Fix jsonwebtoken <=8.5.1 security issue #57

Amine27 opened this issue Jan 1, 2023 · 0 comments

Comments

@Amine27
Copy link

Amine27 commented Jan 1, 2023

Hi,

Can you please fix the security issue of jsonwebtoken package by updating it to v9.0.0. There is no break change AFAIK.

# npm audit report

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
No fix available
node_modules/jsonwebtoken
  @elastic/app-search-node  *
  Depends on vulnerable versions of jsonwebtoken
  node_modules/@elastic/app-search-node

2 vulnerabilities (1 moderate, 1 high)

Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant