PatchTheCVEjson web token vulnerabilities and fixes
Recent CVEs affecting json web token, with upgrade or downgrade steps. 2 tracked.
Also searched as: jsonwebtoken.
json web token has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2023-11-17. Highest priority: CVE-2015-10004 (score 45/100).
- CVE-2023-48238 HIGH 7.5 UPGRADE joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a c
- CVE-2015-10004 HIGH 7.5 MITIGATE Token validation methods are susceptible to a timing side-channel during HMAC comparison
FAQ
How do I fix json web token vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is json web token being exploited right now?
None of the tracked json web token CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which json web token CVE should I patch first?
CVE-2015-10004 currently ranks highest (45/100): Token validation methods are susceptible to a timing side-channel during HMAC comparison.