Description

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

INFO

Published Date :

2025-12-04T18:45:37.517Z

Last Modified :

2025-12-05T18:31:52.043Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-65945 vulnerability.

Vendors Products
Auth0
  • Node-jws
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-65945.

URL Resource
https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e cve-icon cve-icon cve-icon
https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-65945 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-65945 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact