Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

Description

When using the non-default “fallback” crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input.

Recommendation

Update the node-jose package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-5h4j-qrvg-9xhw
• CVE-2023-25653
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• Sending a GET or HEAD request with a body crashes SvelteKit (GHSA-g5m6-hxpp-fc49) - CVE-2024-23641
• msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079

Tags:

npm

node-jose