Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vulnerability in passport-jwt's dependancy jsonwebtoken #244

Closed
rprakash05 opened this issue Dec 22, 2022 · 7 comments · Fixed by #247
Closed

vulnerability in passport-jwt's dependancy jsonwebtoken #244

rprakash05 opened this issue Dec 22, 2022 · 7 comments · Fixed by #247

Comments

@rprakash05
Copy link

Updating to jsonwebtoken's latest version 9.0.0 resolves the vulnerability
Vulnerability details : GHSA-27h2-hvpr-p74q
@PetrShchukin
Copy link

Same here, using it with nest.js for JWT strategies, getting a high vulnerability.
image

@dfernandesbsolus
Copy link

We have the same problem!

@aperona-hai
Copy link

Went ahead and created #245

@Shereef
Copy link

Shereef commented Dec 22, 2022

@mikenicholson Please merge #245 and release ASAP Snyk is stopping our app from going to production with this version

Thank you!

@prince-kumar95
Copy link

I'm too facing this issues with snyk. @mikenicholson please let me know when will this be merged and released.
Thanks

mikenicholson added a commit that referenced this issue Dec 24, 2022
@mikenicholson
Update jsonwebtoken to 9.0.0
bfbc6cc 
Previous version was affected by high severity vulnerability CVE-2022-23529.

Resolves #244
@mikenicholson mikenicholson mentioned this issue Dec 24, 2022
Merged
@mikenicholson
Copy link
Owner

4.0.1 bumps the jsonwebtoken dependnecy and has been release to NPM

@Shereef
Copy link

Shereef commented Dec 25, 2022

Thanks so much !!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update jsonwebtoken to 9.0.0 mikenicholson/passport-jwt
7 participants
@Shereef @mikenicholson @PetrShchukin @aperona-hai @prince-kumar95 @rprakash05 @dfernandesbsolus