njwt Prototype Pollution vulnerability

Description

njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.

Recommendation

Update the njwt package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.1
• Patched version(s): 2.0.1

References

• GHSA-3hvj-2783-34x2
• CVE-2024-34273
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core-base - CVE-2024-52809
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• uPlot Prototype Pollution vulnerability - CVE-2024-21489

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

njwt