cisco node-jose vulnerabilities

Latest cisco node-jose CVEs

Newest publication first

1. CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

   Published 2023-02-16

   High·CVSS 7.5 EPSS 0.55%

   node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) c...

2. CVE-2017-16007 Invalid Curve Attack in node-jose

   Published 2018-06-04

   Medium·CVSS 5.9 EPSS 0.91%

   node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key w...

3. CVE-2018-0114 Cisco node-jose improper validation of JWT signature

   Published 2018-01-04

   High·CVSS 7.5 EPSS 42.7% Public exploit PoC

   A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.