debian/node-jose vulnerabilities

Latest debian/node-jose CVEs

Newest publication first

1. CVE-2022-36083 JOSE vulnerable to resource exhaustion via specifically crafted JWE

   Published 2022-09-07

   Medium·CVSS 5.3

   JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.