A vulnerability has been identified in the open source jsonwebtoken (JWT) library that could allow remote code execution on the affected server when the library is used insecurely. JsonWebToken is an open-source JavaScript package that allows validation of JWTs used for authorization and authentication purposes. The package is maintained by Auth0 and is widely used for authentication and authorization in applications.
The vulnerability, tracked as CVE-2022-23529, affects JsonWebToken versions 8.5.1 and earlier. NVD has since marked this CVE ID as rejected, with the note that the issue is not a vulnerability, while the GitHub advisory still rates it High (CVSS 7.6). If an attacker can change the key argument (secretOrPublicKey) passed to jwt.verify(), they can gain remote code execution. Applications are affected only when they let untrusted parties influence that argument, so the risk lies mainly in the calling code.
JsonWebToken version 9.0.0 adds safer code and extra security checks that address the issue. Users of version 8.5.1 and earlier are encouraged to update to 9.0.0 and to make sure untrusted input never reaches the key argument of jwt.verify().