CVE-2025-65945: auth0/node-jws Improper HMAC Signature Verification Vulnerability
Summary
CVE-2025-65945: auth0/node-jws Improperly Verifies HMAC Signature. Affects jws across 2 version ranges.
< 3.2.3
>= 4.0.0, < 4.0.1
Fixed in 3.2.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
auth0/node-jws is a widely used library for creating and verifying JSON Web Signatures (JWS) in Node.js applications. It supports various algorithms for signing and verifying tokens, making it a crucial component for secure authentication and data integrity. However, certain versions of this library are susceptible to an improper signature verification vulnerability when using the HS256 algorithm, which can lead to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability arises from improper signature verification when using the jws.createVerify() function with HMAC algorithms. If an application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines, it can be exploited by attackers to bypass security checks. This can result in unauthorized access to sensitive data or the ability to forge valid tokens, posing a significant risk to application security.
How To Fix
Latest published version: 4.0.1 as of 22 Oct 2026
npm install jws@4.0.1The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.2.33.2.3npm install jws@3.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider using the jws.verify() interface instead of jws.createVerify() for HMAC algorithms, or switch to asymmetric algorithms like RS256 that are not affected by this vulnerability.
Conclusion
The auth0/node-jws library has a significant vulnerability related to improper HMAC signature verification, which can lead to serious security risks. It is crucial for developers using affected versions to upgrade to the latest patched versions or implement workarounds to mitigate the risk. Regular monitoring with tools like Vulert can help maintain application security.
See every vulnerability recorded for jws →
FAQ
Versions of auth0/node-jws that are affected include 3.2.2 and earlier, as well as 4.0.0.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you to any vulnerabilities, including this one.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
As a temporary measure, you can switch to using the jws.verify() interface or use asymmetric algorithms like RS256 to avoid the vulnerability.
The vulnerability was discovered by Félix Charette, and Okta has acknowledged their contribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for jws.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
