{"id":"CVE-2022-23540","aliases":["CLSA-2026-1774225215","CLSA-2026-1774398084","CLSA-2026-1774657372","CLSA-2026-1776818206","CLSA-2026-1776818208","CLSA-2026-1784683085","CLSA-2026-1784769530","EUVD-2022-7728","GHSA-73v8-v6g4-vrpm","GHSA-qwph-4952-7xr6","ROOT-APP-NPM-CVE-2022-23540"],"status":"published","title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","description":"In versions `\u003c=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00572,"percentile":0.47562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-327","CWE-347"],"published":"2020-09-02T15:58:13Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"npm","package":"decompress-zip","fixed_in":["0.2.2","0.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"jsonwebtoken","fixed_in":["9.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"decompress-zip","fixed_in":["0.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"jsonwebtoken","fixed_in":["0.3.0-tuxcare.1","0.1.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"jsonwebtoken","fixed_in":["8.2.0-aikido.2","8.5.1-aikido.4","8.5.1-aikido.5","8.2.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/jsonwebtoken","fixed_in":["8.5.1-root.io.3","8.2.0-root.io.1","8.2.0-root.io.2","8.5.1-root.io.4","8.5.1-root.io.5","8.2.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"decompress-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.1-tuxcare.0"},{"fixed":"8.5.1-tuxcare.1"}]}],"versions":["8.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0-tuxcare.0"},{"fixed":"0.4.0-tuxcare.6"}]}],"versions":["0.4.0","0.4.0-tuxcare.1","0.4.0-tuxcare.2","0.4.0-tuxcare.3","0.4.0-tuxcare.4","0.4.0-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.1-tuxcare.0"},{"fixed":"0.4.1-tuxcare.3"}]}],"versions":["0.4.1","0.4.1-tuxcare.1","0.4.1-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress-zip","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"jsonwebtoken","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-aikido.2"},{"fixed":"8.5.1-aikido.4"},{"fixed":"8.5.1-aikido.5"},{"fixed":"8.2.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/jsonwebtoken","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.1-root.io.3"},{"fixed":"8.2.0-root.io.1"},{"fixed":"8.2.0-root.io.2"},{"fixed":"8.5.1-root.io.4"},{"fixed":"8.5.1-root.io.5"},{"fixed":"8.2.0-root.io.3"}]}]}],"products":[{"vendor":"auth0","product":"jsonwebtoken"},{"vendor":"auth0","product":"node-jsonwebtoken"}],"references":[{"url":"https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0007/","tags":["x_transferred","advisory"]},{"url":"https://github.com/nodejs/security-wg/blob/master/vuln/npm/488.json","tags":["web"]},{"url":"https://snyk.io/research/zip-slip-vulnerability","tags":["web"]},{"url":"https://www.npmjs.com/advisories/777","tags":["web"]},{"url":"https://github.com/advisories/GHSA-73v8-v6g4-vrpm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwph-4952-7xr6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23540.json","tags":["advisory"]},{"url":"https://github.com/auth0/node-jsonwebtoken","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23540","title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","description":"In versions `\u003c=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T18:02:24.77Z","modified":"2025-02-13T16:32:21.578Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-7728","description":"In versions `\u003c=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T18:02:24Z","modified":"2025-02-13T16:32:21Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:52.752782Z"}],"ghsa":[{"id":"GHSA-qwph-4952-7xr6","title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","description":"# Overview\n\nIn versions \u003c=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.\n\n# Am I affected?\nYou will be affected if all the following are true in the `jwt.verify()` function:\n- a token with no signature is received\n- no algorithms are specified \n- a falsy (e.g. null, false, undefined) secret or key is passed \n\n# How do I fix it?\n \nUpdate to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. \n\n# Will the fix impact my users?\n\nThere will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T03:32:59Z","modified":"2025-02-13T18:33:13Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-287","CWE-327","CWE-347"],"updated_at":"2026-11-02T14:38:30.754382Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2023-01-09T05:03:36Z","updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2022-23540","description":"In versions `\u003c=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T19:15:08.967Z","modified":"2026-06-17T04:30:19.267Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-287","CWE-347"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-23540","title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","description":"In versions `\u003c=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T18:02:24.77Z","modified":"2026-10-28T02:31:08.201523679Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-qwph-4952-7xr6","title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","description":"# Overview\n\nIn versions \u003c=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.\n\n# Am I affected?\nYou will be affected if all the following are true in the `jwt.verify()` function:\n- a token with no signature is received\n- no algorithms are specified \n- a falsy (e.g. null, false, undefined) secret or key is passed \n\n# How do I fix it?\n \nUpdate to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. \n\n# Will the fix impact my users?\n\nThere will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","status":"published","published":"2022-12-22T03:32:59Z","modified":"2025-02-13T18:33:13Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-287","CWE-327","CWE-347"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CLSA-2026-1774225215","title":"TuxCare security update for decompress-zip (1 CVE)","description":"TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:47.954897089Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398084","title":"TuxCare security update for git-clone (5 CVEs)","description":"TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:15Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774657372","title":"TuxCare security update for jsonwebtoken (3 CVEs)","description":"TuxCare rebuilt jsonwebtoken to address 3 CVEs. Fixed in 8.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.482531338Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776818206","title":"TuxCare security update for jsonwebtoken (2 CVEs)","description":"TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.6.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:47.165006311Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776818208","title":"TuxCare security update for jsonwebtoken (3 CVEs)","description":"TuxCare rebuilt jsonwebtoken to address 3 CVEs. Fixed in 0.4.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:45.676261562Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784683085","title":"TuxCare security update for jsonwebtoken (1 CVE)","description":"TuxCare rebuilt jsonwebtoken to address 1 CVE. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.152194053Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769530","title":"TuxCare security update for jsonwebtoken (1 CVE)","description":"TuxCare rebuilt jsonwebtoken to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.752213144Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"GHSA-73v8-v6g4-vrpm","title":"Arbitrary File Overwrite in decompress-zip","description":"Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.\n\n\n\n## Recommendation\n\nFor `decompress-zip` 0.2.x upgrade to 0.2.2 or later.\nFor `decompress-zip` 0.3.x upgrade to 0.3.2 or later.","status":"published","published":"2020-09-02T15:58:13Z","modified":"2020-08-31T18:35:21Z","updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"ROOT-APP-NPM-CVE-2022-23540","title":"CVE-2022-23540 in jsonwebtoken - Patched by Root","description":"Root has patched CVE-2022-23540 in the jsonwebtoken package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-11T06:46:09Z","modified":"2026-08-11T09:00:04.944360507Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}