Read the docs
TI-2025-40515 Aliases CVE-2025-65945GHSA-869p-cjfg-cm3x

auth0/node-jws improper HMAC signature verification vulnerability

Priority LOW 38CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 11 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 14th percentileScored 2026-11-07
Fix Partial node-jws (auth0): 3.2.3jws (npm): 3.2.3, 4.0.1Red Hat: 13 advisoriesRed Hat: 11 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0node-jwsbefore 3.2.3; 4.0.0 – 4.0.13.2.3Patch availableCNA
—jws (npm)before 3.2.33.2.3Patch availableGHSA-869p-cjfg-cm3x
—jws (npm)4.0.0 to before 4.0.14.0.1Patch availableGHSA-869p-cjfg-cm3x
  • node-jws Vendorauth0 Affected before 3.2.3; 4.0.0 – 4.0.1 Fixed in 3.2.3 Patch available CNA
  • jws (npm) Vendor— Affected before 3.2.3 Fixed in 3.2.3 Patch available GHSA-869p-cjfg-cm3x
  • jws (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-869p-cjfg-cm3x

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:auth0:node-jws:*:*:*:*:*:node.js:*:*before 3.2.3Vulnerableauth0
cpe:2.3:a:auth0:node-jws:4.0.0:*:*:*:*:node.js:*:*4.0.0Vulnerableauth0
  • cpe:2.3:a:auth0:node-jws:*:*:*:*:*:node.js:*:* Versions before 3.2.3 Vulnerable ·auth0
  • cpe:2.3:a:auth0:node-jws:4.0.0:*:*:*:*:node.js:*:* Versions 4.0.0 Vulnerable ·auth0

Remediation

  • Fix · CNA node-jws (auth0) Fixed in 3.2.3
  • Fix · GHSA-869p-cjfg-cm3x jws (npm) Fixed in 3.2.3 Advisory →
  • Fix · GHSA-869p-cjfg-cm3x jws (npm) Fixed in 4.0.1 Advisory →

Red Hat 13 advisories

  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
Show 10 more Red Hat advisories
  • RHSA-2026:2922 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9 +1
  • RHSA-2026:2921 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/createtree-rhel9
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:0531 Released 2026-01-13 · Red Hat rating Important
    Red Hat Developer Hub 1.8.2 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:0261 Released 2026-01-07 · Red Hat rating Important
    Red Hat Developer Hub 1.7.4 release.
    • Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat Developer Hub 1.7Fixed RHSA-2026:0261
Red Hat Developer Hub 1.8Fixed RHSA-2026:0531
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2026:2681
Red Hat Quay 3.9Fixed RHSA-2026:2754
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2921, RHSA-2026:2922, RHSA-2026:2926
Not affected: 18 products
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Security 4
  • Red Hat Developer Hub 1.7
  • Red Hat Developer Hub 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer 1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65945
  2. 2026-10-03 Alias added: GHSA-869p-cjfg-cm3x

References

Patch 1

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences