CVE-2017-16007

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

• CWE-200

• http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.htmlExploit, Third Party Advisory
• https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4aePatch, Third Party Advisory
• https://github.com/cisco/node-joseThird Party Advisory
• https://nodesecurity.io/advisories/324Third Party Advisory
• http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.htmlExploit, Third Party Advisory
• https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4aePatch, Third Party Advisory
• https://github.com/cisco/node-joseThird Party Advisory
• https://nodesecurity.io/advisories/324Third Party Advisory

Published

Jun 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1600IBM Security Guardium 10.0 Database Activity Monitor is vuln…
• CVE-2017-16000SQL injection vulnerability in the EyesOfNetwork web interfa…
• CVE-2017-16001In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmwar…
• CVE-2017-16003windows-build-tools is a module for installing C++ Build Too…
• CVE-2017-16005Http-signature is a "Reference implementation of Joyent's HT…
• CVE-2017-16006Remarkable is a markdown parser. In versions 1.6.2 and lower…
• CVE-2017-16008i18next is a language translation framework. Because of how …
• CVE-2017-16009ag-grid is an advanced data grid that is library agnostic. a…6.1
• CVE-2017-1601IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 …
• CVE-2017-16010i18next is a language translation framework. When using the …
• CVE-2017-16011Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-16012Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…