rootio-joserfc vulnerabilities (Root)

3 vulnerabilities.

• rootio-joserfc Root joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVE-2026-49852 Fix available 8.7 HighJuly 2, 2026
• rootio-joserfc Root joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization CVE-2026-48990 Fix available 5.3 MediumJune 17, 2026
• rootio-joserfc Root joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) CVE-2026-27932 Fix available 7.5 HighMarch 2, 2026