CVE-2022-23539

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.

• CWE-327

• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3Patch, Third Party Advisory
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3Patch, Third Party Advisory
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0007/

Published

Dec 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23531GuardDog is a CLI tool to identify malicious PyPI packages. …7.8
• CVE-2022-23532APOC (Awesome Procedures on Cypher) is an add-on library for…6.5
• CVE-2022-23535LiteDB is a small, fast and lightweight .NET NoSQL embedded …9.8
• CVE-2022-23536Cortex provides multi-tenant, long term storage for Promethe…6.5
• CVE-2022-23537PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23538github.com/sylabs/scs-library-client is the Go client for th…7.6
• CVE-2022-2354The WP-DBManager WordPress plugin before 2.80.8 does not pre…7.2
• CVE-2022-23540In versions `<=8.5.1` of `jsonwebtoken` library, lack of alg…7.6
• CVE-2022-23541jsonwebtoken is an implementation of JSON Web Tokens. Versio…6.3
• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8
• CVE-2022-23543Silverware Games is a social network where people can play g…5.4
• CVE-2022-23544MeterSphere is a one-stop open source continuous testing pla…6.1