Skip to content

2026-02-03 — jsonwebtoken type confusion → potential authz bypass (GHSA-h395-gr6q-cpjc)

What happened: The jsonwebtoken library had a type confusion issue that could lead to a potential authorization bypass in some integration patterns.

Why it matters: JWT vulnerabilities are often “sharp edges”: - a small parsing/typing bug can become auth bypass depending on how claims are interpreted - the impact depends heavily on application logic (roles, audiences, issuers)

Durable guidance (defensive)

  1. Upgrade immediately

  2. Treat auth libraries as high-risk dependencies.

  3. Validate claims defensively

  4. Enforce types and presence for required claims (sub, aud, iss, expiry).

  5. Reject unexpected types (arrays/objects where you expect a string).

  6. Pin and enforce algorithms

  7. Do not accept alg from the token as policy.

  8. Explicitly allowlist expected algorithms.

  9. Separate “verification” from “authorization”

  10. Verification proves the token is valid.
  11. Authorization must be done against a strict, app-defined schema.

References