TI-2017-11734 Aliases CVE-2017-16007 GHSA-rvj9-8cvx-3vq9

Information disclosure in HackerOne node-jose node module

LOW 28CWE-200Published 2018-06-04 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

Why it matters now

EPSS 0.00913 60th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed node-jose node module (HackerOne): 0.9.3node-jose (npm): 0.9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	node-jose node module	before 0.9.3	0.9.3	Patch available	CNA
—	node-jose (npm)	before 0.9.3	0.9.3	Patch available	GHSA-rvj9-8cvx-3vq9

node-jose node module VendorHackerOne Affected before 0.9.3 Fixed in 0.9.3 Patch available CNA
node-jose (npm) Vendor— Affected before 0.9.3 Fixed in 0.9.3 Patch available GHSA-rvj9-8cvx-3vq9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:node-jose::::::node.js::*	before 0.9.3	Vulnerable	Cisco

cpe:2.3:a:cisco:node-jose:*:*:*:*:*:node.js:*:* Versions before 0.9.3 Vulnerable ·Cisco

Remediation

Fix · CNA node-jose node module (HackerOne) Fixed in 0.9.3
Fix · GHSA-rvj9-8cvx-3vq9 node-jose (npm) Fixed in 0.9.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2017-16007
2026-10-03 Alias added: GHSA-rvj9-8cvx-3vq9

References

Exploit 1

http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html

Patch 1

https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae

Advisory 3

Other 3

TI-2018-00089 Improper signature verification in Node-jose Library CVSS 3.1HIGH 7.5
TI-2023-10934 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences