Repository navigation
Security: Keats/jsonwebtoken
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
HS256/384/512 verify accepts an empty HMAC key (from_secret and oct JWK k="") enabling token forgeryGHSA-698m-q5wh-jf73 published
Nov 13, 2026 by KeatsHigh -
Wrong-typed aud, iss or sub claims skip validation (incomplete GHSA-h395 fix)GHSA-4gj5-m54m-9gq6 published
Nov 13, 2026 by KeatsModerate -
Type Confusion leads to potential authorization bypassGHSA-h395-gr6q-cpjc published
Feb 3, 2026 by KeatsModerate
Learn more about advisories related to Keats/jsonwebtoken in the GitHub Advisory Database