CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. ## Recommendation Update to version 4.2.2 or later.

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. ## Recommendation Update to version 4.2.2 or later.

En el módulo jsonwebtoken node en versiones anteriores a la 4.2.2 es posible que un atacante omita la verificación cuando un token firmado digitalmente con una clave asimétrica (familia RS/ES) de algoritmos pero, en su lugar, el atacante envía un token firmado digitalmente con un algoritmo simétrico (familia HS*).