Keats jsonwebtoken vulnerabilities

Latest Keats jsonwebtoken CVEs

Newest publication first

1. CVE-2026-25537 jsonwebtoken has Type Confusion that leads to potential authorization bypass

   Published 2026-02-04

   Medium·CVSS 5.5 EPSS 0.50%

   jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.