Out-of-bounds Read Vulnerability in njwt
Summary
GHSA-g3qw-9pgp-xpj4: Out-of-bounds Read in njwt. Affects njwt versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
njwt is an npm package that provides JSON Web Token (JWT) functionality. It allows users to encode, decode, and manipulate JWTs. The package is widely used in Node.js applications for implementing authentication and authorization mechanisms. However, versions prior to 1.0.0 are vulnerable to an out-of-bounds read issue when a number is passed into the base64urlEncode function.
Vulnerability Detail
The out-of-bounds read vulnerability in njwt arises due to improper handling of input data. When a number is provided as input to the base64urlEncode function, it can lead to out-of-bounds memory access. On Node.js 6.x or lower, this can result in the exposure of sensitive information. On any other version of Node.js, it can cause a Denial of Service (DoS) vulnerability.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
npm install njwt@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The out-of-bounds read vulnerability in njwt can lead to the exposure of sensitive information or cause a Denial of Service (DoS) vulnerability. It is crucial to upgrade to version 1.0.0 of the njwt package to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for njwt →
FAQ
njwt is an npm package that provides JSON Web Token (JWT) functionality. It allows users to encode, decode, and manipulate JWTs.
An out-of-bounds read vulnerability occurs when a program accesses memory outside the bounds of a defined buffer. In this case, it can lead to the exposure of sensitive information or cause a Denial of Service (DoS) vulnerability.
On Node.js 6.x or lower, this vulnerability can expose sensitive information. On any other version of Node.js, it creates a Denial of Service (DoS) vulnerability.
You can check the version of njwt installed in your project by running the following command in your project directory:
npm list njwt
No, there is no known workaround for this vulnerability. It is recommended to upgrade to version 1.0.0 of the njwt package.
References
Related vulnerabilities
Recent vulnerabilities recorded for njwt.
