CVE-2025-65945 auth0/node-jws improper HMAC signature verification vulnerability
Attackers can bypass HMAC signature verification in node-jws by manipulating protected headers or payloads, allowing unauthorized access to applications relying on this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65945?
CVE-2025-65945 is a high-severity vulnerability in auth0 node-jws, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Weakness: CWE-347
Which versions are affected by CVE-2025-65945?
4 open source packages ship an affected version, including jws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jws npm | All versions | 3.2.3 |
jws npm | All versions | 3.2.3 |
jws npm | From 4.0.0 | 4.0.1 |
jws npm | From 4.0.0 | 4.0.1 |
Products include Auth0 Node-Jws.
How do I fix CVE-2025-65945?
Upgrade jws to a fixed version for your release line: 3.2.3 or 4.0.1.
Is CVE-2025-65945 being exploited?
There is no known exploitation of CVE-2025-65945 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-FE11294, CLEANSTART-2026-XB11024, ECHO-c071-de61-1600, GHSA-869p-cjfg-cm3x, MINI-2p9x-vxfr-j53h, MINI-3cwx-5r3h-rqrr and 11 more.