Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

panva/jose

              main @ b299ce2
            

Fixes

CVEs

HIGH

Peak severity

55.6%

Coverage

Highlights

Denial of Service: 8 prior fixes. Scrutinize any change in this area.

lib/jwk/import.js: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Unbounded computational expense during key derivation. Attackers can specify arbitrarily high PBES2 PBKDF2 iteration counts (p2c) in JWE headers, leading to severe CPU exhaustion. This is a recurring vulnerability tracked across multiple versions (CVE-2022-36083, CVE-2023-50967).

Auth Bypass: Critical signature validation bypass occurs when an asynchronous signature verification operation returns a Promise. Because a Promise object is inherently truthy in JavaScript, the library mistakenly accepted the signature as valid without awaiting the actual resolution.

Denial of Service: Vulnerability to zip-bomb attacks during decryption. JWE payloads using the 'zip' compression header could decompress without size limits, causing high memory and CPU utilization (CVE-2024-28176).