npm jose-node-cjs-runtime vulnerabilities

Latest npm jose-node-cjs-runtime CVEs

Newest publication first

1. CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

   Published 2024-03-09

   Medium·CVSS 5.9 EPSS 2.1%

   jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryptio...

2. CVE-2022-36083 JOSE vulnerable to resource exhaustion via specifically crafted JWE

   Published 2022-09-07

   Medium·CVSS 5.3 EPSS 1.6%

   JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count...

3. CVE-2021-29446 Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

   Published 2021-04-16

   Medium·CVSS 5.9 EPSS 1.1%

   jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.