Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package jose, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (3)
CVE-2021-29443 — CVSS 5.9 (medium): jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256…
CVE-2022-36083 — CVSS 5.3 (medium): JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js…
CVE-2024-28176 — CVSS 4.9 (medium): jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS)…