{"answers":{"affected":"4 open source packages ship an affected version, including jws. It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-65945 in the wild and no public exploit code.","fix":"Upgrade jws to a fixed version for your release line: 3.2.3 or 4.0.1.","what":"CVE-2025-65945 is a high-severity vulnerability in auth0 node-jws, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-65945 and fix it if it is affected.\n\nWhat it is: CVE-2025-65945 is a high-severity vulnerability in auth0 node-jws, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-65945 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- jws (npm): affected all versions; fixed in 3.2.3\n- jws (npm): affected all versions; fixed in 3.2.3\n- jws (npm): affected from 4.0.0; fixed in 4.0.1\n- jws (npm): affected from 4.0.0; fixed in 4.0.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-65945/ (Markdown: https://insights.sbomify.com/CVE-2025-65945/index.md)","id":"CVE-2025-65945","markdown":"https://insights.sbomify.com/CVE-2025-65945/index.md","name":"CVE-2025-65945","record":{"aliases":["CLEANSTART-2026-FE11294","CLEANSTART-2026-XB11024","ECHO-c071-de61-1600","GHSA-869p-cjfg-cm3x","MINI-2p9x-vxfr-j53h","MINI-3cwx-5r3h-rqrr","MINI-3qvc-v8m2-8cj3","MINI-434m-rw38-3vvw","MINI-52gv-52r4-2x4r","MINI-5h6q-33jw-9vcx","MINI-5q3f-gq44-c25g","MINI-95jw-6wwc-f2m2","MINI-c5xv-fvhm-4586","MINI-gw79-ccxg-m3hf","MINI-wf2m-gw8q-px4v","MINI-xqvr-q3mx-2889","ROOT-APP-NPM-CVE-2025-65945"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js JWS library","requires_auth":"none","summary":"Attackers can bypass HMAC signature verification in node-jws by manipulating protected headers or payloads, allowing unauthorized access to applications relying on this library.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"node-jws","vendor":"auth0"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"description":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":"2025-12-17","github_poc":1,"max_poc_stars":4,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-12-17T15:52:03Z","kind":"github_poc","ref":"https://github.com/jedisct1/CVE-2025-65945-poc","stars":4,"title":"PoC for CVE-2025-65945 (Improper Verification of Cryptographic Signature in node-jws)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"auth0/node-jws improper HMAC signature verification vulnerability","id":"CVE-2025-65945","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"security_feature_bypass","year":"2025"},"n_packages":4,"n_references":2,"next":{"headline":"Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug","id":"CVE-2025-65946"},"packages":[{"ecosystem":"npm","fixed":["3.2.3"],"introduced":["0"],"last_affected":[],"package":"jws","purl":null,"source":"GHSA-869p-cjfg-cm3x"},{"ecosystem":"npm","fixed":["3.2.3"],"introduced":["0"],"last_affected":[],"package":"jws","purl":"pkg:npm/jws","source":"GHSA-869p-cjfg-cm3x"},{"ecosystem":"npm","fixed":["4.0.1"],"introduced":["4.0.0"],"last_affected":[],"package":"jws","purl":null,"source":"GHSA-869p-cjfg-cm3x"},{"ecosystem":"npm","fixed":["4.0.1"],"introduced":["4.0.0"],"last_affected":[],"package":"jws","purl":"pkg:npm/jws","source":"GHSA-869p-cjfg-cm3x"}],"prev":{"headline":"Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`","id":"CVE-2025-65944"},"products":["node-jws"],"published":"2025-12-04","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-12-05","vendors":["auth0"]},"summary":"Attackers can bypass HMAC signature verification in node-jws by manipulating protected headers or payloads, allowing unauthorized access to applications relying on this library.","url":"https://insights.sbomify.com/CVE-2025-65945/"}