Read the docs
TI-2022-07594 Aliases CVE-2022-23539GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage

Priority LOW 36CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.

Summary

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Partial jsonwebtoken (npm): 9.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0node-jsonwebtokenup to 8.5.1—No fix listedCNA
—jsonwebtoken (npm)before 9.0.09.0.0Patch availableGHSA-8cf7-32gw-wr33
  • node-jsonwebtoken Vendorauth0 Affected up to 8.5.1 Fixed in — No fix listed CNA
  • jsonwebtoken (npm) Vendor— Affected before 9.0.0 Fixed in 9.0.0 Patch available GHSA-8cf7-32gw-wr33

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:*up to 8.5.1Vulnerableauth0
  • cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* Versions up to 8.5.1 Vulnerable ·auth0

Remediation

  • Fix · GHSA-8cf7-32gw-wr33 jsonwebtoken (npm) Fixed in 9.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3265 Released 2023-05-23 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update
    • RHODF 4.12 for RHEL 8 odf4/mcg-core-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
RHODF 4.12 for RHEL 8Fixed RHSA-2023:3265
Not affected: 1 product
  • RHODF 4.12 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23539
  2. 2026-10-03 Alias added: GHSA-8cf7-32gw-wr33

References

Patch 1

Advisory 2

Other 3

  • TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
  • TI-2022-07595 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() CVSS 3.1HIGH 7.6
  • TI-2022-07596 Improper authentication in auth0 node-jsonwebtoken CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences