package

npm/jsonwebtoken

pkg:npm/jsonwebtoken

HIGH8.1npm

jsonwebtoken unrestricted key type could lead to legacy keys usage

Modified: 6/24/2024

CRITICALnpm

Verification Bypass in jsonwebtoken

Modified: 9/10/2026

MEDIUM5.0npm

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

Modified: 6/24/2024

MEDIUM6.4npm

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Modified: 2/13/2025