Read the docs
TI-2022-16506 Aliases CVE-2022-36083GHSA-jv3g-j58f-9mq9

JOSE vulnerable to resource exhaustion via specifically crafted JWE

Priority MEDIUM 63CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01639 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed jose (panva): 1.28.2, 2.0.6, 3.20.4 +1jose (npm): 1.28.2, 2.0.6, 3.20.4 +1+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
panvajose1.0 to before 1.28.2; 2.0 to before 2.0.6; 3.0 to before 3.20.4; 4.0 to before 4.9.21.28.2, 2.0.6, 3.20.4, 4.9.2Patch availableCNA
—jose (npm)1.0.0 to before 1.28.21.28.2Patch availableGHSA-jv3g-j58f-9mq9
—jose-browser-runtime (npm)3.0.0 to before 3.20.43.20.4Patch availableGHSA-jv3g-j58f-9mq9
—jose-node-cjs-runtime (npm)3.0.0 to before 3.20.43.20.4Patch availableGHSA-jv3g-j58f-9mq9
—jose-node-esm-runtime (npm)3.0.0 to before 3.20.43.20.4Patch availableGHSA-jv3g-j58f-9mq9
—jose (npm)2.0.0 to before 2.0.62.0.6Patch availableGHSA-jv3g-j58f-9mq9
—jose (npm)3.0.0 to before 3.20.43.20.4Patch availableGHSA-jv3g-j58f-9mq9
—jose (npm)4.0.0 to before 4.9.24.9.2Patch availableGHSA-jv3g-j58f-9mq9
—jose-browser-runtime (npm)4.0.0 to before 4.9.24.9.2Patch availableGHSA-jv3g-j58f-9mq9
—jose-node-cjs-runtime (npm)4.0.0 to before 4.9.24.9.2Patch availableGHSA-jv3g-j58f-9mq9
—jose-node-esm-runtime (npm)4.0.0 to before 4.9.24.9.2Patch availableGHSA-jv3g-j58f-9mq9
  • jose Vendorpanva Affected 1.0 to before 1.28.2; 2.0 to before 2.0.6; 3.0 to before 3.20.4; 4.0 to before 4.9.2 Fixed in 1.28.2, 2.0.6, 3.20.4, 4.9.2 Patch available CNA
  • jose (npm) Vendor— Affected 1.0.0 to before 1.28.2 Fixed in 1.28.2 Patch available GHSA-jv3g-j58f-9mq9
  • jose-browser-runtime (npm) Vendor— Affected 3.0.0 to before 3.20.4 Fixed in 3.20.4 Patch available GHSA-jv3g-j58f-9mq9
  • jose-node-cjs-runtime (npm) Vendor— Affected 3.0.0 to before 3.20.4 Fixed in 3.20.4 Patch available GHSA-jv3g-j58f-9mq9
  • jose-node-esm-runtime (npm) Vendor— Affected 3.0.0 to before 3.20.4 Fixed in 3.20.4 Patch available GHSA-jv3g-j58f-9mq9
  • jose (npm) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-jv3g-j58f-9mq9
  • jose (npm) Vendor— Affected 3.0.0 to before 3.20.4 Fixed in 3.20.4 Patch available GHSA-jv3g-j58f-9mq9
  • jose (npm) Vendor— Affected 4.0.0 to before 4.9.2 Fixed in 4.9.2 Patch available GHSA-jv3g-j58f-9mq9
  • jose-browser-runtime (npm) Vendor— Affected 4.0.0 to before 4.9.2 Fixed in 4.9.2 Patch available GHSA-jv3g-j58f-9mq9
  • jose-node-cjs-runtime (npm) Vendor— Affected 4.0.0 to before 4.9.2 Fixed in 4.9.2 Patch available GHSA-jv3g-j58f-9mq9
  • jose-node-esm-runtime (npm) Vendor— Affected 4.0.0 to before 4.9.2 Fixed in 4.9.2 Patch available GHSA-jv3g-j58f-9mq9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:panva:jose:*:*:*:*:*:node.js:*:*1.0.0 to before 1.28.2; 2.0.0 to before 2.0.6; 3.0.0 to before 3.20.4; 4.0.0 to before 4.9.2Vulnerablepanva
  • cpe:2.3:a:panva:jose:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 1.28.2; 2.0.0 to before 2.0.6; 3.0.0 to before 3.20.4; 4.0.0 to before 4.9.2 Vulnerable ·panva

Remediation

  • Fix · CNA jose (panva) Fixed in 1.28.2, 2.0.6, 3.20.4, 4.9.2
  • Fix · GHSA-jv3g-j58f-9mq9 jose (npm) Fixed in 1.28.2 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-browser-runtime (npm) Fixed in 3.20.4 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-node-cjs-runtime (npm) Fixed in 3.20.4 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-node-esm-runtime (npm) Fixed in 3.20.4 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose (npm) Fixed in 2.0.6 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose (npm) Fixed in 3.20.4 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose (npm) Fixed in 4.9.2 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-browser-runtime (npm) Fixed in 4.9.2 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-node-cjs-runtime (npm) Fixed in 4.9.2 Advisory →
  • Fix · GHSA-jv3g-j58f-9mq9 jose-node-esm-runtime (npm) Fixed in 4.9.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36083
  2. 2026-10-03 Alias added: GHSA-jv3g-j58f-9mq9

References

Exploit 1

Patch 1

Advisory 2

Other 1

  • TI-2021-10156 Padding Oracle Attack due to Observable Timing Discrepancy in jose CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences