GHSA-5pj7-wx9m-cjh6

Facts

Severity

High · CVSS score 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions (web-token/jwt-library)

< 3.4.12As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-library)

3.4.12

Affected versions (web-token/jwt-library)

>= 4.0.0, < 4.0.8As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-library)

4.0.8

Affected versions (web-token/jwt-library)

>= 4.1.0, < 4.1.10As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-library)

4.1.10

Affected versions (web-token/jwt-library)

>= 4.2.0, < 4.2.4As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-library)

4.2.4

Affected versions (web-token/jwt-framework)

< 3.4.12As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-framework)

3.4.12

Affected versions (web-token/jwt-framework)

>= 4.0.0, < 4.0.8As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-framework)

4.0.8

Affected versions (web-token/jwt-framework)

>= 4.1.0, < 4.1.10As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-framework)

4.1.10

Affected versions (web-token/jwt-framework)

>= 4.2.0, < 4.2.4As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-framework)

4.2.4

Affected versions (web-token/jwt-encryption-algorithm-ecdh-es)

<= 3.2.10As entered by the maintainer. Not reviewed.

Fixed in (web-token/jwt-encryption-algorithm-ecdh-es)

not stated

CVE

None cited by the advisory

GitHub Advisory Database

Not reviewed

OSV.dev

Not present

Other CVEs pointing here

None found in the CVE List

Timeline

1. 2026-10-31 07:01 UTC

   Published by the maintainers

   No CVE cited

2. 2026-11-01 13:37 UTC

   First seen by Limbowatch

   not reviewed · not in OSV

3. Waiting

   Reviewed by GitHub

4. Waiting

   In OSV; scanners can see it

Machine-readable record: feed/GHSA-5pj7-wx9m-cjh6.json