GHSA-4rr6-gf59-ggw5
namshi/jose - Verification bypass
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
What each source reports
GitHub AdvisoriesNo score
namshi/jose - Verification bypass
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-4rr6-gf59-ggw5- Updated
- 2026-11-02
OSVNo score
namshi/jose - Verification bypass
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-4rr6-gf59-ggw5- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
namshi/josePackagist | before 2.2.0 | 2.2.0 |
namshi/josePackagist | before 2.2.0, plus listed versions 1.0.01.0.0-beta11.0.0-rc11.0.11.0.2 Show 15 moreShow less1.1.01.1.11.1.21.2.01.2.11.2.22.0.02.0.12.0.22.0.32.1.02.1.12.1.22.1.32.1.4 | 2.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4rr6-gf59-ggw5 is a vulnerability with no CVSS score yet in namshi/jose, published May 17, 2024. No source lists public exploit code. Fixed in namshi/jose 2.2.0.