auth0/node-jws Improperly Verifies HMAC Signature
Overview
An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.
Am I Affected?
You are affected by this vulnerability if you meet all of the following preconditions:
- Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0
- Application uses the jws.createVerify() function for HMAC algorithms
- Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
You are NOT affected by this vulnerability if you meet any of the following preconditions:
- Application uses the jws.verify() interface (note:
auth0/node-jsonwebtokenusers fall into this category and are therefore NOT affected by this vulnerability) - Application uses only asymmetric algorithms (e.g. RS256)
- Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines
Fix
Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1
Acknowledgement
Okta would like to thank Félix Charette for discovering this vulnerability.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | jws | < 3.2.3, >= 4.0.0, < 4.0.1 | 3.2.3, 4.0.1 |
References
- https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
- https://nvd.nist.gov/vuln/detail/CVE-2025-65945
- https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
- https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
- https://github.com/auth0/node-jws
- https://github.com/auth0/node-jws/releases/tag/v3.2.3
- https://github.com/auth0/node-jws/releases/tag/v4.0.1
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-347- Platform
- npm
- Package
jws- Disclosed
- 04.12.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-869p-cjfg-cm3x - CC BY 4.0
Vulnerability history: jws
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 09.2020 12.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 0
-
auth0/node-jws Improperly Verifies HMAC Signature this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.