njwt Prototype Pollution vulnerability

Description

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.

Recommendation

Update the njwt package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.1
• Patched version(s): 2.0.1

References

• GHSA-3hvj-2783-34x2
• CVE-2024-34273
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Elliptic allows BER-encoded signatures - CVE-2024-42461
• crypto-js uses insecure random numbers - CVE-2020-36732
• ejs lacks certain pollution protection - CVE-2024-33883
• Cross-site scripting in Survey Creator - CVE-2024-28635

Tags:

npm

njwt