Executive brief
njwt is a Node.js library for creating and verifying JSON Web Tokens (JWTs), commonly used for authentication and secure information exchange. A flaw in its base64urlEncode function can cause an out-of-bounds read when handling numeric input, potentially exposing sensitive data on older Node.js versions or causing service disruptions on newer versions.
Technical details
The vulnerability is a classic out-of-bounds read (CWE-125) in the base64urlEncode function of njwt versions prior to 1.0.0. When a number is passed as input to this function, the code fails to properly validate bounds before accessing memory, leading to out-of-bounds read operations. On Node.js 6.x and earlier, this can expose sensitive information from adjacent memory regions; on Node.js 7.x and later, it manifests as a Denial of Service. The vulnerability is triggered by application-level code that passes numeric values to base64urlEncode, and is fixed by upgrading to version 1.0.0.
Affected products
- njwt njwt < 1.0.0
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: Fix available in version 1.0.0