GHSA-869p-cjfg-cm3x
High · 7.5CVSS
7.5
EPSS
—
Published
Dec 4, 2025
CISA due date
—
The record
auth0/node-jws Improperly Verifies HMAC Signature
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | jws | 0 | 3.2.3 |
| npm | jws | 4.0.0 | No fix |
| npm | jws | 4.0.0 | 4.0.1 |
| Chainguard | dbgate | 0 | 6.8.0-r0 |
| Chainguard | dbgate-compat | 0 | 6.7.3-r0 |
| Chainguard | dbgate-fips | 0 | 6.8.0-r0 |
| Chainguard | dbgate-fips-compat | 0 | 6.7.3-r0 |
| Chainguard | jitsucom-jitsu | 0 | 2.11.0-r10 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r10 |
| Chainguard | jitsucom-jitsu-rotor | 0 | 2.11.0-r10 |
| Chainguard | kibana-8.17 | 0 | 8.17.10-r5 |
| Chainguard | kibana-8.17-bitnami | 0 | 8.17.10-r5 |
| Chainguard | kibana-8.17-iamguarded | 0 | 8.17.10-r5 |
| Chainguard | kibana-8.18 | 0 | 8.18.8-r4 |
| Chainguard | kibana-8.18-bitnami | 0 | 8.18.8-r4 |
| Chainguard | kibana-8.18-iamguarded | 0 | 8.18.8-r4 |
| Chainguard | kibana-8.19 | 0 | 8.19.8-r1 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.8-r1 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.8-r1 |
| Chainguard | kibana-9.0 | 0 | 9.0.8-r4 |
| Chainguard | kibana-9.0-bitnami | 0 | 9.0.8-r4 |
| Chainguard | kibana-9.0-iamguarded | 0 | 9.0.8-r4 |
| Chainguard | kibana-9.1 | 0 | 9.1.8-r2 |
| Chainguard | kibana-9.1-bitnami | 0 | 9.1.8-r2 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.8-r2 |
| Chainguard | kibana-9.2 | 0 | 9.2.2-r2 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.2-r2 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r7 |
| Chainguard | kubeflow-pipelines | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r2 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r2 |
| Chainguard | langfuse-3 | 0 | 3.138.0-r0 |
| Chainguard | langfuse-3-compat | 0 | 3.138.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.138.0-r0 |
| Chainguard | langfuse-fips-3 | 0 | 3.138.0-r0 |
| Chainguard | langfuse-fips-3-compat | 0 | 3.138.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.138.0-r0 |
| Chainguard | langfuse-web-3 | 0 | 3.138.0-r0 |
| Chainguard | langfuse-web-compat | 0 | 3.138.0-r0 |
| Chainguard | langfuse-worker-3 | 0 | 3.138.0-r0 |
| Chainguard | librechat | 0 | 0.8.0-r8 |
| Chainguard | librechat-compat | 0 | 0.8.0-r8 |
| Chainguard | librechat-dev | 0 | 0.8.0-r8 |
| Chainguard | redisinsight | 0 | 3.0.0-r0 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 3.0.0-r0 |
| Chainguard | renovate | 0 | 42.39.1-r0 |
| Chainguard | saf | 0 | 1.5.2-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r4 |
| Chainguard | sqlpad-compat | 0 | 7.5.7-r4 |
| Wolfi | jitsucom-jitsu | 0 | 2.11.0-r10 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r10 |
| Wolfi | jitsucom-jitsu-rotor | 0 | 2.11.0-r10 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r7 |
| Wolfi | kubeflow-pipelines | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r2 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r2 |
| Wolfi | langfuse-3 | 0 | 3.138.0-r0 |
| Wolfi | langfuse-3-compat | 0 | 3.138.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.138.0-r0 |
| Wolfi | langfuse-web-3 | 0 | 3.138.0-r0 |
| Wolfi | langfuse-web-compat | 0 | 3.138.0-r0 |
| Wolfi | langfuse-worker-3 | 0 | 3.138.0-r0 |
| Wolfi | renovate | 0 | 42.39.1-r0 |
| Wolfi | saf | 0 | 1.5.2-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r4 |
| Wolfi | sqlpad-compat | 0 | 7.5.7-r4 |
Related vulnerabilities
- CVE-2025-65945 auth0/node-jws is a JSON Web Signature implementation for Node.js. Same vulnerability
- CVE-2026-33349 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects dbgate
- CVE-2026-33036 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects dbgate
- GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in… Also affects dbgate
- GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… Also affects dbgate
- GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder Also affects dbgate
- CVE-2026-27942 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from… Also affects dbgate
- CVE-2026-25896 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from… Also affects dbgate