Vulnerabilities for jwcrypto

First version without a known vulnerability: 1.5.7

Details

• GHSA-fjrm-76x2-c4q42026-04-08

  JWCrypto: JWE ZIP decompression bomb

  Fixed in: 1.5.7

• GHSA-j857-7rvv-vj972024-03-06

  JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

  Fixed in: 1.5.6

• GHSA-cw2r-4p82-qv792023-12-28

  DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value

  Fixed in: 1.5.1

• GHSA-gwp4-mcv4-w95j2022-09-21

  jwcrypto token substitution can lead to authentication bypass

  Fixed in: 1.4

• GHSA-wg33-x934-3ghh2022-05-17

  jwcrypto lacks the Random Filling protection mechanism

  Fixed in: 0.3.2, eb5be5bd94c8cae1d7f3ba9801377084d8e5a7ba, 0.4.0