joserfc
- Software type
- Software library
- Total vulnerabilities (90 days)
- 3
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/24/2026, joserfc recorded 3 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of joserfc and determine which vulnerabilities affect that version.
CVE-2026-102946joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonCVE-2026-75509joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)CVE-2026-62995joserfc accepts JWT with padding, leading to JWT malleabilityCVE-2026-49852joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)CVE-2026-48990joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization7 Results | Page 1 of 1