Read the docs
TI-2025-37324 Aliases CVE-2025-59936GHSA-qc2q-qhf3-235m

get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

Priority HIGH 80CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub.

Summary

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Fix Fixed get-jwks (nearform): 11.0.2get-jwks (npm): 11.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nearformget-jwksbefore 11.0.211.0.2Patch availableCNA
—get-jwks (npm)before 11.0.211.0.2Patch availableGHSA-qc2q-qhf3-235m
  • get-jwks Vendornearform Affected before 11.0.2 Fixed in 11.0.2 Patch available CNA
  • get-jwks (npm) Vendor— Affected before 11.0.2 Fixed in 11.0.2 Patch available GHSA-qc2q-qhf3-235m

Remediation

  • Fix · CNA get-jwks (nearform) Fixed in 11.0.2
  • Fix · GHSA-qc2q-qhf3-235m get-jwks (npm) Fixed in 11.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59936
  2. 2026-10-03 Alias added: GHSA-qc2q-qhf3-235m

References

Advisory 1

Other 3

  • TI-2026-69702 Incomplete fix in fast-jwt enables RSA to HS256 algorithm confusion CVSS 3.1CRITICAL 9.8
  • TI-2026-27174 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key CVSS 3.1CRITICAL 9.1
  • TI-2026-27245 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
  • TI-2026-69684 Claim validator bypass in fast-jwt when JWT payload is a JSON array CVSS 3.1HIGH 8.1
  • TI-2026-69695 fast-jwt accepts public JWK JSON as HMAC key, enabling token forgery CVSS 3.1HIGH 7.4
  • TI-2026-69689 fast-jwt accepts unsigned JWTs when the key is empty or null CVSS 3.1HIGH 7.4
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences