GHSA-g3qw-9pgp-xpj4 Out-of-bounds Read in njwt
An out-of-bounds read in the njwt library allows attackers to expose sensitive information or cause denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-g3qw-9pgp-xpj4?
GHSA-g3qw-9pgp-xpj4 is a vulnerability in njwt, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function.
On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability.
Recommendation
Upgrade to version 1.0.0.
Which versions are affected by GHSA-g3qw-9pgp-xpj4?
2 open source packages ship an affected version, including njwt.
| Package | Affected | Fixed in |
|---|---|---|
njwt npm | All versions | 1.0.0 |
njwt npm | All versions | 1.0.0 |
How do I fix GHSA-g3qw-9pgp-xpj4?
Upgrade njwt to 1.0.0 or later.
Is GHSA-g3qw-9pgp-xpj4 being exploited?
There is no known exploitation of GHSA-g3qw-9pgp-xpj4 in the wild and no public exploit code.