jsonwebtoken (npm)

JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

Advisories

Latest version

9.0.3

Released Dec 4, 2025

License

MIT

OpenSSF Scorecard

5.4 / 10

How to fix

Upgrading to 9.0.0 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install jsonwebtoken@9.0.3

yarn

yarn add jsonwebtoken@9.0.3

pnpm

pnpm add jsonwebtoken@9.0.3

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-hjrf-2m68-5959 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC	Medium EPSS 0.81%	`< 9.0.0`	`9.0.0`
GHSA-qwph-4952-7xr6 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()	High EPSS 0.57%	`< 9.0.0`	`9.0.0`
GHSA-8cf7-32gw-wr33 jsonwebtoken unrestricted key type could lead to legacy keys usage	High EPSS 0.52%	`< 9.0.0`	`9.0.0`
GHSA-27h2-hvpr-p74q jsonwebtoken has insecure input validation in jwt.verify function Withdrawn	High	`< 9.0.0`	`9.0.0`
GHSA-c7hr-j4mj-j2w6 Verification Bypass in jsonwebtoken	Critical EPSS 8.52%	`< 4.2.2`	`4.2.2`

Source: git+https://github.com/auth0/node-jsonwebtoken.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor