Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

keats/jsonwebtoken

              master @ 6086da7
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

src/validation.rs: most-fixed (9 issues). Treat as high-risk during review.

15 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Type confusion during claims deserialization (e.g., treating non-integer values for 'exp' or 'nbf' as absent) allowed attackers to bypass time-based security checks. Developers must ensure strict deserialization types are enforced for all standard claims.

Auth Bypass: Algorithm-switching or key-confusion attacks allowed attackers to present tokens using unexpected key types or algorithms. Strong validation must map and constrain key families against the user-specified expected validation algorithms during decoding.

Cryptographic Issues: Verifying base64-encoded signature strings directly instead of parsing and verifying the decoded raw bytes resulted in a critical cryptographic validation bypass. Implementation must guarantee raw bytes are fed directly to cryptographic verifiers.