CVE-2022-23529
jsonwebtoken has insecure input validation in jwt.verify function
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-27h2-hvpr-p74q
jsonwebtoken has insecure input validation in jwt.verify function
Overview
For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE).
Am I affected?
This security issue is a concern when the jsonwebtoken library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the jwt.verify() on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.
How do I fix it?
Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.
- Record
GHSA-27h2-hvpr-p74q- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.
- Record
CVE-2022-23529- Updated
- 2026-11-02
EUVDEUVD-2022-7472 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.
- Record
EUVD-2022-7472- Updated
- 2026-11-03
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.
- Record
CVE-2022-23529- Updated
- 2026-11-02
OSVGHSA-27h2-hvpr-p74q
jsonwebtoken has insecure input validation in jwt.verify function
Overview
For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE).
Am I affected?
This security issue is a concern when the jsonwebtoken library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the jwt.verify() on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.
How do I fix it?
Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.
- Record
GHSA-27h2-hvpr-p74q- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-23529 No score
CVE-2022-23529 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-23529- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jsonwebtokenRoot:npm |
before 0.1.0-aikido.5 | 0.1.0-aikido.50.1.0-aikido.48.5.1-aikido.58.2.0-aikido.30.4.0-aikido.4 |
@rootio/jsonwebtokenRoot:npm |
before 0.1.0-root.io.5 | 0.1.0-root.io.50.1.0-root.io.48.5.1-root.io.58.2.0-root.io.30.4.0-root.io.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | daniel-marchi/CVE-2022-23529-Exploration | 2023-05-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23529 has been rejected by its source and should not be treated as a live vulnerability, published December 21, 2022. Public exploit code exists. Fixed in jsonwebtoken 0.1.0-aikido.5.