CVE-2022-23529: Insecure Input Validation in jsonwebtoken Library
Summary
GHSA-27h2-hvpr-p74q: jsonwebtoken has insecure input validation in jwt.verify function. Affects jsonwebtoken versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsonwebtoken library is an npm package that provides functionality for creating and verifying JSON Web Tokens (JWTs). It is commonly used in Node.js applications to implement authentication and authorization mechanisms. JWTs are used to securely transmit information between parties as a JSON object. The jsonwebtoken library allows developers to generate, sign, and verify JWTs. However, versions <=8.5.1 of the library have a vulnerability in the jwt.verify() function that can be exploited by a malicious actor to execute remote code on the host system.
Vulnerability Detail
The vulnerability arises from insecure input validation in the jwt.verify() function of the jsonwebtoken library. If an attacker can modify the key retrieval parameter (secretOrPublicKey) of the function, they can potentially gain remote code execution (RCE) capabilities. This can lead to unauthorized access, data breaches, and other malicious activities. It is important to note that the vulnerability is not inherent to the library itself, but rather depends on how it is used in the calling code. Users are only affected if they allow untrusted entities to modify the key retrieval parameter on a host that they control.
How To Fix
Latest published version: 9.0.3 as of 23 Oct 2026
npm install jsonwebtoken@9.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
npm install jsonwebtoken@9.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of the jsonwebtoken library.
Conclusion
The jsonwebtoken library has a vulnerability in the jwt.verify() function that can be exploited to execute remote code on the host system. Users of the library should update to version 9.0.0 to fix this vulnerability and prevent potential unauthorized access and data breaches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jsonwebtoken →
FAQ
If you are using jsonwebtoken library version 8.5.1 or earlier and you allow untrusted entities to modify the key retrieval parameter of the jwt.verify() function on a host that you control, you may be affected by this vulnerability.
Exploiting this vulnerability can lead to remote code execution (RCE) on the host system. This can result in unauthorized access, data breaches, and other malicious activities.
No, the vulnerability is not inherent to the jsonwebtoken library. It depends on how the library is used in the calling code. The library has been updated to version 9.0.0 to address this specific vulnerability.
The recommended mitigation is to update to the latest version of the jsonwebtoken library, which includes security fixes and improved input validation in the jwt.verify() function.
You can find more information about this vulnerability in the GitHub Security Advisory database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-27h2-hvpr-p74q/GHSA-27h2-hvpr-p74q.json
References
Related vulnerabilities
Recent vulnerabilities recorded for jsonwebtoken.
