Vulnerabilities for joserfc

First version without a known vulnerability: 1.6.8

Details

• GHSA-gg9x-qcx2-xmrh2026-07-02

  joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

  Fixed in: 1.6.8

• GHSA-wphv-vfrh-23q52026-06-26

  joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

  Fixed in: 1.6.7

• GHSA-w5r5-m38g-f9f92026-03-02

  joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

  Fixed in: 1.6.3

• GHSA-frfh-8v73-gjg42025-11-18

  joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

  Fixed in: 1.3.5, 1.4.2