CVE-2026-102265: PyJWT Uncaught RecursionError in jwt.decode() on Deeply Nested Token Header
Summary
CVE-2026-102265: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header. Affects pyjwt versions >= 2.13.0, < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyJWT is a Python library that allows developers to encode and decode JSON Web Tokens (JWT). It is widely used for authentication and information exchange in web applications. The library provides a simple interface for creating and verifying tokens, making it a popular choice for securing APIs. However, a vulnerability has been identified in version 2.13.0 that affects the handling of deeply nested JSON arrays in token headers, potentially leading to denial of service attacks.
Vulnerability Detail
The vulnerability arises from the way PyJWT's PyJWS._load() function processes the compact token. When the header segment of the token contains a deeply nested JSON array, the JSON decoder in CPython raises a RecursionError instead of the expected ValueError. This error is not caught by the existing exception handling in the library, allowing an unauthenticated attacker to trigger a server error (HTTP 500) instead of the intended authentication failure (HTTP 401). The recursion threshold is approximately 65,000 nesting levels, making it possible to exploit this vulnerability with a specially crafted token.
How To Fix
Latest published version: 2.15.1 as of 23 Oct 2026
pip install --upgrade "pyjwt==2.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.0
This is the first release that contains the fix.
pip install --upgrade "pyjwt==2.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on the token header before passing it to jwt.decode(). For example, you can limit the depth of the JSON structure or reject tokens that exceed a certain size. Here is a sample code snippet to limit the depth:
import json
def validate_token_header(header):
try:
json.loads(header)
except json.JSONDecodeError:
return False
if header.count('[') > 100: # Limit nesting depth
return False
return True
Conclusion
The vulnerability CVE-2026-102265 in PyJWT allows for denial of service attacks through improperly handled deeply nested JSON arrays in token headers. It is crucial to update to version 2.14.0 or later to mitigate this risk. Implementing validation on token headers can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for pyjwt →
FAQ
An unauthenticated attacker can exploit this vulnerability to cause a denial of service by triggering server errors on every request to a JWT validating endpoint.
The vulnerability has been tested and verified on PyJWT version 2.13.0. Any version that does not handle RecursionError in the _load() function is also affected.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring access to the code or installation. Visit Vulert Scanner for more information.
If you cannot update the package, consider implementing a workaround by validating the token header to limit its depth or size before processing it.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyjwt.
