GitHub Advisoryadvisory · npm
GHSA-g3qw-9pgp-xpj4 Out-of-bounds Read in njwt
LOW
Official page ↗
- Ecosystem
- npm
- Packages
- njwt
- Severity
- Low
- Weaknesses
- CWE-125
- Reviewed
- 2020-08-31
Affected packages
• npm njwt: < 1.0.0 → fixed in 1.0.0
Description
Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function.
On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability.
Recommendation
Upgrade to version 1.0.0.
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness