CVE-2022-23539, CVE-2022-23541, CVE-2022-23540: Security Update for jsonwebtoken

Published: Dec 21, 2022

CVE numbers: CVE-2022-23539, CVE-2022-23541, CVE-2022-23540

Auth0 has released a new major version of the jsonwebtoken library to address four vulnerabilities.

We recommend you review the following security advisories and upgrade to the new major version:

• Unrestricted key type could lead to legacy keys usage: CVE-2022-23539

• Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC: CVE-2022-23541

• Insecure default algorithm in jwt.verify() could lead to signature validation bypass: CVE-2022-23540

You could be affected if you are using jsonwebtoken in any version <= 8.5.1 depending on the configuration. Please consult the individual security advisories for more details.

If you are using jsonwebtoken, upgrade to version 9.0.0 or higher. You may need some additional configuration. Please consult the individual security advisories for more details.

Updating to version 9.0.0 may impact your users depending on your configuration and application needs. Please consult the individual security advisories for more details.