# CVE-2025-65945: jws — Fixed in 3.2.3 📦 📦 npm Not in CISA KEV HIGH severity # CVE-2025-65945 — jws HIGH [Fix: auth0/node-jws@34c45b2](https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e) CVE-2025-65945 is a high-severity (CVSS 7.5) CWE-347 vulnerability in jws. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for jws — see the affected versions and patch details below. auth0/node-jws improper HMAC signature verification vulnerability Also known as[GHSA-869p-cjfg-cm3x](/vulnerability/GHSA-869p-cjfg-cm3x) Published Dec 4, 2025 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits 1 known Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-65945. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk+0.02% Lower risk than most CVEs14th percentile — riskier than 14% of all scored CVEsHighest risk 0.00%0.24%0.49%0.73%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 2 pkgs affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 469other npm packages depend on this — each one inherits the vulnerability until it's patched upstream `jws`npm 122.8Mdownloads / week ## Description #### Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. #### Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions: 1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0 2. Application uses the jws.createVerify() function for HMAC algorithms 3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines You are NOT affected by this vulnerability if you meet any of the following preconditions: 1. Application uses the jws.verify() interface (note: `auth0/node-jsonwebtoken` users fall into this category and are therefore NOT affected by this vulnerability) 2. Application uses only asymmetric algorithms (e.g. RS256) 3. Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines #### Fix Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1 #### Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 📦npm `jws` all versions 3.2.3`npm install jws@3.2.3` 📦npm `jws` ≥ 4.0.0&&< 4.0.1 4.0.1`npm install jws@4.0.1` ## Affected Products 1 product · 2 configurations Application `node-jws`auth0 < 3.2.3 1 version 4.0.0 Exploits & PoCs 1 Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization. [ jedisct1/CVE-2025-65945-poc PoC for CVE-2025-65945 (Improper Verification of Cryptographic Signature ⭐ 5🍴 1Dec 2025 ](https://github.com/jedisct1/CVE-2025-65945-poc) ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jws, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update jws to 3.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-65945 is resolved across your whole dependency graph. 3. ### Workarounds If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant Workaround published by Red Hat > Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Source: [Red Hat security advisory for CVE-2025-65945](https://access.redhat.com/security/cve/cve-2025-65945) (CC BY 4.0) Product Fixed in Advisory Red Hat Developer Hub 1.7 `rhdh/rhdh-hub-rhel9:1.7.4-1767715042` [RHSA-2026:0261](https://access.redhat.com/errata/RHSA-2026:0261) Red Hat Developer Hub 1.8 `rhdh/rhdh-hub-rhel9:1768247401` [RHSA-2026:0531](https://access.redhat.com/errata/RHSA-2026:0531) Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 `devspaces/code-rhel9:1769804221` [RHSA-2026:2456](https://access.redhat.com/errata/RHSA-2026:2456) Red Hat Quay 3.10 `quay/quay-rhel8:1770249183` [RHSA-2026:2762](https://access.redhat.com/errata/RHSA-2026:2762) Red Hat Quay 3.12 `quay/quay-rhel8:1769852013` [RHSA-2026:1730](https://access.redhat.com/errata/RHSA-2026:1730) Red Hat Quay 3.13 `quay/quay-rhel8:1773088862` [RHSA-2026:4185](https://access.redhat.com/errata/RHSA-2026:4185) Red Hat Quay 3.14 `quay/quay-rhel8:1773097621` [RHSA-2026:4215](https://access.redhat.com/errata/RHSA-2026:4215) Red Hat Quay 3.15 `quay/quay-rhel8:1770146565` [RHSA-2026:1942](https://access.redhat.com/errata/RHSA-2026:1942) ## Frequently Asked Questions \### Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. ### Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions: 1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0 2. Application uses the jws.createVerify() function for HMAC algorithms 3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines You are NOT affected by this vulnerabi O3 Security · Impact-Aware SCA ### Is CVE-2025-65945 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)