# CVE-2021-29445: jose-node-esm-runtime padding oracle in AES-CBC-HMAC decryption

Source: https://junglewise.ai/threats/cve-2021-29445-jose-node-esm-runtime-padding-oracle-in-aes-cbc-hmac-decryption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-04-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-29445 · Severity: low · CVSS 3.1 · Published 2021-04-19

The jose-node-esm-runtime library is used to handle JSON Web Encryption (JWE) and cryptographic operations in Node.js applications. A timing side-channel vulnerability in its AES-CBC-HMAC decryption allows attackers to decrypt encrypted messages without the key by exploiting observable differences in how long decryption takes. This could lead to unauthorized disclosure of encrypted data handled by applications using vulnerable versions of the library.

Technologies: [jose-node-esm-runtime (npm)](https://junglewise.ai/threats/technologies/jose-node-esm-runtime). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-29445 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-29445 being exploited in the wild.

**How severe is CVE-2021-29445?** Low severity, with a CVSS score of 3.1, published 19 April 2021.

**Which products and versions are affected?** jose-node-esm-runtime (npm) SEMVER:introduced=0,fixed=3.11.4.

**Is there a fix for CVE-2021-29445?** Yes. jose-node-esm-runtime (npm): upgrade to 3.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-29445 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-29445?** Check whether you run jose-node-esm-runtime (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jose-node-esm-runtime (npm): upgrade to 3.11.4 or later

  ```sh
  npm install jose-node-esm-runtime@3.11.4
  ```


## Technical details

The vulnerability is a timing-based padding oracle in the AES_CBC_HMAC_SHA2 decryption algorithm (variants A128CBC-HS256, A192CBC-HS384, A256CBC-HS512). The root cause is that both HMAC tag verification and CBC decryption are executed regardless of which fails, and padding validation errors occur at a different point in execution than HMAC failures, creating a measurable timing difference. This allows an attacker without network or authentication prerequisites to recover plaintext by issuing repeated decryption requests and measuring response times to identify which padding values are valid. The fix (released in version ≥3.11.4) reorders operations to verify the HMAC tag before performing CBC decryption, eliminating the observable timing discrepancy. The patch is available and users should upgrade immediately.

## Affected products

- panva jose-node-esm-runtime < 3.11.4

## Identifiers

- CVE-2021-29445
- GHSA-4v4g-726h-xvfv

## Timeline

- 2021-04-15: disclosed
- 2021-04-16: patched: version 3.11.4 released with fix

## References

- [https://github.com/panva/jose/security/advisories/GHSA-4v4g-726h-xvfv](https://github.com/panva/jose/security/advisories/GHSA-4v4g-726h-xvfv)
- [https://github.com/panva/jose](https://github.com/panva/jose)
- [https://www.npmjs.com/package/jose-node-esm-runtime](https://www.npmjs.com/package/jose-node-esm-runtime)

## Related threats

- [jose resource exhaustion via compressed JWE plaintext](https://junglewise.ai/threats/cve-2024-28176-jose-resource-exhaustion-via-compressed-jwe-plaintext)
- [JOSE JWE resource exhaustion via high PBKDF2 iteration count](https://junglewise.ai/threats/cve-2022-36083-jose-jwe-resource-exhaustion-via-high-pbkdf2-iteration-count)