Is CVE-2025-65945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65945 being exploited in the wild.

How severe is CVE-2025-65945?

High severity, with a CVSS score of 7.5, published 4 December 2025.

Which products and versions are affected?

Auth0 Jws <= 3.2.2, 4.0.0; jws (npm) SEMVER:introduced=0,fixed=3.2.3.

Is there a fix for CVE-2025-65945?

Yes. jws (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65945 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-65945?

Check whether you run Auth0 Jws or jws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65945: Auth0 node-jws signature verification bypass in HS256 algorithm

Q: Which products and versions are affected?

Auth0 Jws <= 3.2.2, 4.0.0; jws (npm) SEMVER:introduced=0,fixed=3.2.3.

Q: Is there a fix for CVE-2025-65945?

Yes. jws (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-65945 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-65945?

Check whether you run Auth0 Jws or jws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65945 · Severity: high · CVSS 7.5 · Published 2025-12-04

Auth0 node-jws is a software library used by developers to sign and verify digital tokens (JSON Web Signatures) in Node.js applications. A security flaw in certain versions allows attackers to bypass signature verification, meaning they could potentially forge or modify data that the application should have rejected as untrusted. This could lead to unauthorized actions or data manipulation if the application relies on these signatures for security decisions.

Vendors: Auth0, npm.

Quick answers

Is CVE-2025-65945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65945 being exploited in the wild.
How severe is CVE-2025-65945?: High severity, with a CVSS score of 7.5, published 4 December 2025.
Which products and versions are affected?: Auth0 Jws <= 3.2.2, 4.0.0; jws (npm) SEMVER:introduced=0,fixed=3.2.3.
Is there a fix for CVE-2025-65945?: Yes. jws (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65945 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-65945?: Check whether you run Auth0 Jws or jws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jws (npm): upgrade to 3.2.3 or later
```
npm install jws@3.2.3
```

Technical details

An improper signature verification vulnerability (CWE-347) exists in auth0/node-jws when using the HS256 algorithm. The issue occurs when an application uses the jws.createVerify() function for HMAC algorithms and incorporates user-provided data from the JWS protected header or payload into the HMAC secret lookup routine. Under these conditions, an attacker can provide crafted input that causes the verification process to succeed even with an invalid signature. The vulnerability is present in versions up to 3.2.2 and version 4.0.0. It has been patched in versions 3.2.3 and 4.0.1 by requiring a non-empty secret for HMAC operations. Applications using the jws.verify() interface or asymmetric algorithms (like RS256) are not affected.

Affected products

Auth0 node-jws <= 3.2.2, 4.0.0

Identifiers

CVE-2025-65945
GHSA-869p-cjfg-cm3x

Timeline

2025-12-04: disclosed
2025-12-04: patched
2025-12-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.