| Version | Supported |
|---|---|
| 4.1.x | ✅ |
| 4.0.x | ❌ |
| 3.4.x | ✅ |
| < 3.4.0 | ❌ |
If you think you have found a security issue, DO NOT open an issue. You MUST email your issue: security AT spomky-labs.com.
Repository navigation
Security: web-token/jwt-framework
Security
SECURITY.md
-
RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracleGHSA-5739-39v2-5754 published
Jun 6, 2026 by SpomkyModerate -
Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryptionGHSA-6vvh-pxr4-25r7 published
Jun 6, 2026 by SpomkyModerate -
PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of serviceGHSA-3prj-6hqw-cm82 published
Jun 6, 2026 by SpomkyHigh -
JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacksGHSA-jc38-x7x8-2xc8 published
Jun 6, 2026 by SpomkyHigh
Learn more about advisories related to web-token/jwt-framework in the GitHub Advisory Database