github.com/golang-jwt/jwt/v4 (Go)
Go implementation of JSON Web Tokens (JWT).
Advisories
4
Latest version
v4.5.2
Released Mar 21, 2025
License
MIT
OpenSSF Scorecard
7.5 / 10
How to fix
Upgrading to 4.5.2 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/golang-jwt/jwt/v4@v4.5.2 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mh63-6h87-95cp jwt-go allows excessive memory allocation during header parsing |
High EPSS 0.81% |
< 4.5.2 | 4.5.2 |
| GHSA-mh63-6h87-95cp jwt-go allows excessive memory allocation during header parsing |
High EPSS 0.81% |
< 4.5.2 | 4.5.2 |
| GHSA-29wx-vh33-7x7r Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations |
Low EPSS 0.58% |
< 4.5.1 | 4.5.1 |
| GHSA-29wx-vh33-7x7r Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations |
Low EPSS 0.58% |
< 4.5.1 | 4.5.1 |
Source: https://github.com/golang-jwt/jwt
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor