CVE-2025-65945

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e	Patch
https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:auth0:node-jws::::::node.js::*
	cpe:2.3:a:auth0:node-jws:4.0.0:::::node.js::

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) auth0/node-jws es una implementación de JSON Web Signature para Node.js. En las versiones 3.2.2 y anteriores y la versión 4.0.0, auth0/node-jws tiene una vulnerabilidad de verificación de firma incorrecta al usar el algoritmo HS256 bajo condiciones específicas. Las aplicaciones se ven afectadas cuando utilizan la función jws.createVerify() para algoritmos HMAC y usan datos proporcionados por el usuario del encabezado protegido o la carga útil de JSON Web Signature en rutinas de búsqueda de secretos HMAC, lo que puede permitir a los atacantes eludir la verificación de la firma. Este problema ha sido parcheado en las versiones 3.2.3 y 4.0.1.

Information

Published : 2025-12-04 19:16

Updated : 2026-10-18 15:10

NVD link : CVE-2025-65945

Mitre link : CVE-2025-65945

CVE.ORG link : CVE-2025-65945

JSON object : View

Products Affected

auth0

node-jws

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2025-65945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T18:31:41.971989Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "auth0", "product": "node-jws", "versions": [{"status": "affected", "version": "< 3.2.3"}, {"status": "affected", "version": ">= 4.0.0, <= 4.0.1"}]}]}], "published": "2025-12-04T19:16:05.550", "references": [{"url": "https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1."}, {"lang": "es", "value": "auth0/node-jws es una implementaci\u00f3n de JSON Web Signature para Node.js. En las versiones 3.2.2 y anteriores y la versi\u00f3n 4.0.0, auth0/node-jws tiene una vulnerabilidad de verificaci\u00f3n de firma incorrecta al usar el algoritmo HS256 bajo condiciones espec\u00edficas. Las aplicaciones se ven afectadas cuando utilizan la funci\u00f3n jws.createVerify() para algoritmos HMAC y usan datos proporcionados por el usuario del encabezado protegido o la carga \u00fatil de JSON Web Signature en rutinas de b\u00fasqueda de secretos HMAC, lo que puede permitir a los atacantes eludir la verificaci\u00f3n de la firma. Este problema ha sido parcheado en las versiones 3.2.3 y 4.0.1."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:auth0:node-jws:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F1C8129F-C686-45DF-B134-8C4A6541904F", "versionEndExcluding": "3.2.3"}, {"criteria": "cpe:2.3:a:auth0:node-jws:4.0.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BD4CB854-F566-459E-A79C-7ED9CD64A8CC"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}