PatchTheCVECVE-2023-48238: joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a c
CVE-2023-48238 is a high-severity flaw (CVSS 7.5) affecting json web token. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus s
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 76%) |
| CISA exploited list | No |
| Weakness | CWE-345 |
| Published | 2023-11-17 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-48238?
json web token: upgrade to 3.1.1. Exact commands for each OS are on this page.
Is CVE-2023-48238 being exploited?
CVE-2023-48238 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-48238 affect?
CVE-2023-48238 affects json web token. Severity is high (CVSS 7.5). joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JW
How urgent is CVE-2023-48238?
Priority 42/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2015-10004 HIGH 7.5 MITIGATE Token validation methods are susceptible to a timing side-channel during HMAC comparison