{"id":"CVE-2025-65945","sourceIdentifier":"security-advisories@github.com","published":"2025-12-04T19:16:05.550","lastModified":"2026-10-18T15:10:00.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1."},{"lang":"es","value":"auth0/node-jws es una implementación de JSON Web Signature para Node.js. En las versiones 3.2.2 y anteriores y la versión 4.0.0, auth0/node-jws tiene una vulnerabilidad de verificación de firma incorrecta al usar el algoritmo HS256 bajo condiciones específicas. Las aplicaciones se ven afectadas cuando utilizan la función jws.createVerify() para algoritmos HMAC y usan datos proporcionados por el usuario del encabezado protegido o la carga útil de JSON Web Signature en rutinas de búsqueda de secretos HMAC, lo que puede permitir a los atacantes eludir la verificación de la firma. Este problema ha sido parcheado en las versiones 3.2.3 y 4.0.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"auth0","product":"node-jws","versions":[{"version":"< 3.2.3","status":"affected"},{"version":">= 4.0.0, <= 4.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-05T18:31:41.971989Z","id":"CVE-2025-65945","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:auth0:node-jws:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.2.3","matchCriteriaId":"F1C8129F-C686-45DF-B134-8C4A6541904F"},{"vulnerable":true,"criteria":"cpe:2.3:a:auth0:node-jws:4.0.0:*:*:*:*:node.js:*:*","matchCriteriaId":"BD4CB854-F566-459E-A79C-7ED9CD64A8CC"}]}]}],"references":[{"url":"https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}