CVE-2022-23541: Insecure Implementation of Key Retrieval Function in jsonwebtoken
Summary
CVE-2022-23541: Overview Versions. Affects jsonwebtoken versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsonwebtoken library is an npm package used for generating and verifying JSON Web Tokens (JWTs) in Node.js applications. It provides a set of functions for signing and verifying tokens using various algorithms and key types. However, versions <=8.5.1 of jsonwebtoken suffer from a misconfiguration that can lead to incorrect verification of tokens. This vulnerability allows for the possibility of using a different algorithm and key combination in verification than the one used to sign the tokens. As a result, tokens signed with an asymmetric public key can be successfully verified with a symmetric HS256 algorithm, leading to the validation of forged tokens.
Vulnerability Detail
The vulnerability arises from a misconfiguration in the key retrieval function (secretOrPublicKey argument) of the jsonwebtoken library. If an application supports the usage of both symmetric and asymmetric keys in the jwt.verify() implementation with the same key retrieval function, an attacker can exploit this misconfiguration to forge tokens. By signing a token with an asymmetric public key and then verifying it with a symmetric HS256 algorithm, the attacker can bypass the intended security measures and successfully validate the forged token. This can potentially lead to unauthorized access, privilege escalation, and other security breaches.
How To Fix
Latest published version: 9.0.3 as of 23 Oct 2026
npm install jsonwebtoken@9.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
npm install jsonwebtoken@9.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the jsonwebtoken library to the fixed version (9.0.0 or later) to mitigate the risk of token forgery.
Conclusion
The jsonwebtoken library versions up to and including 8.5.1 suffer from a misconfiguration that allows for the validation of forged tokens. By updating to version 9.0.0 or later, the vulnerability can be fixed, ensuring that tokens are verified using the correct algorithm and key combination. It is crucial to promptly update the library to mitigate the risk of unauthorized access and other security breaches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jsonwebtoken →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities, including this one.
The vulnerability allows for the validation of forged tokens, which can lead to unauthorized access, privilege escalation, and other security breaches. An attacker could impersonate legitimate users, gain unauthorized privileges, or tamper with sensitive data.
No, only versions up to and including 8.5.1 of the jsonwebtoken library are affected by this vulnerability. Updating to version 9.0.0 or later will fix the issue.
There is no impact on end users directly. However, if the vulnerability is exploited, it can lead to unauthorized access and compromise the security of the application and its users.
Manually verifying tokens can be error-prone and may not provide the necessary security measures. It is recommended to update the jsonwebtoken library to the fixed version (9.0.0 or later) to ensure proper token verification.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsonwebtoken.
