PatchTheCVE: jose-node-cjs-runtime projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-29446: jose-node-cjs-runtime is an npm package which provides a number of cryptographic functionshttps://patchthecve.com/cve/CVE-2021-29446.htmlhttps://patchthecve.com/cve/CVE-2021-29446.htmlWed, 17 Jun 2026 03:47:39 +0000MEDIUM 5.9: jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDeCVE-2021-29445: jose-node-esm-runtime is an npm package which provides a number of cryptographic functionshttps://patchthecve.com/cve/CVE-2021-29445.htmlhttps://patchthecve.com/cve/CVE-2021-29445.htmlWed, 17 Jun 2026 03:47:39 +0000MEDIUM 5.9: jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDeCVE-2021-29444: jose-browser-runtime is an npm package which provides a number of cryptographic functionshttps://patchthecve.com/cve/CVE-2021-29444.htmlhttps://patchthecve.com/cve/CVE-2021-29444.htmlWed, 17 Jun 2026 03:47:39 +0000MEDIUM 5.9: jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDec