GitHub Advisoryadvisory · npm

GHSA-g3qw-9pgp-xpj4 Out-of-bounds Read in njwt

LOW Published 2020-09-01 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
njwt
Severity
Low
Weaknesses
CWE-125
Reviewed
2020-08-31

Affected packages

• npm njwt: < 1.0.0 → fixed in 1.0.0

Description

Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade to version 1.0.0.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References