njwt Prototype Pollution vulnerability

Description

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.

Recommendation

Update the njwt package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.1
• Patched version(s): 2.0.1

References

• GHSA-3hvj-2783-34x2
• CVE-2024-34273
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @75lb/deep-merge Prototype Pollution vulnerability - CVE-2024-38986
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
• @thi.ng/paths Prototype Pollution vulnerability - CVE-2024-29650

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

njwt