JWS and JWT signature validation vulnerability with special characters

Description

Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.

Recommendation

Update the jsrsasign package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.8.0, < 10.5.25
• Patched version(s): 10.5.25

References

• GHSA-3fvg-4v2m-98jf
• cve.mitre.org
• snyk.io
• CVE-2022-25898
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign - CVE-2020-14967
• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) - Vulnerability
• Predictable results in nanoid generation when given non-integer values - CVE-2024-55565

Tags:

npm

jsrsasign