GHSA-hhhv-q57g-882q moderate
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
Affected range
SEMVER: introduced 3.0.0; fixed 4.15.5SEMVER: introduced 0; fixed 2.0.7Fixed versions: 4.15.5, 2.0.7
jose
JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes
npm latest 6.2.12 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
6.2.12
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Moderate
3 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-58f5-hfqc-jgch moderate
Padding Oracle Attack due to Observable Timing Discrepancy in jose
Affected range
SEMVER: introduced 1.0.0; fixed 1.28.1SEMVER: introduced 2.0.0; fixed 2.0.5SEMVER: introduced 3.0.0; fixed 3.11.4Fixed versions: 1.28.1, 2.0.5, 3.11.4
GHSA-jv3g-j58f-9mq9 moderate
JOSE vulnerable to resource exhaustion via specifically crafted JWE
Affected range
SEMVER: introduced 1.0.0; fixed 1.28.2SEMVER: introduced 2.0.0; fixed 2.0.6SEMVER: introduced 3.0.0; fixed 3.20.4SEMVER: introduced 4.0.0; fixed 4.9.2Fixed versions: 1.28.2, 2.0.6, 3.20.4, 4.9.2