Executive brief
Auth0 node-jws is a software library used by developers to sign and verify digital tokens (JSON Web Signatures) in Node.js applications. A security flaw in certain versions allows attackers to bypass signature verification, meaning they could potentially forge or modify data that the application should have rejected as untrusted. This could lead to unauthorized actions or data manipulation if the application relies on these signatures for security decisions.
Technical details
An improper signature verification vulnerability (CWE-347) exists in auth0/node-jws when using the HS256 algorithm. The issue occurs when an application uses the jws.createVerify() function for HMAC algorithms and incorporates user-provided data from the JWS protected header or payload into the HMAC secret lookup routine. Under these conditions, an attacker can provide crafted input that causes the verification process to succeed even with an invalid signature. The vulnerability is present in versions up to 3.2.2 and version 4.0.0. It has been patched in versions 3.2.3 and 4.0.1 by requiring a non-empty secret for HMAC operations. Applications using the jws.verify() interface or asymmetric algorithms (like RS256) are not affected.
Affected products
- Auth0 node-jws <= 3.2.2, 4.0.0
Timeline
- 2025-12-04: disclosed
- 2025-12-04: patched
- 2025-12-04: advisory