Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-10 | 1 | Disclosure1 |
| 2026-06-01 | 1 | Patch1 |
@mem0ai Dependency hardening → Pinned jws to 4.0.1 (CVE-2025-65945) → Pinned tar-fs to ^2.1.4 (CVE-2025-48387, CVE-2025-59343) → Pinned @modelcontextprotocol/sdk to ^1.25.4 (CVE-2025-66414, CVE-2026-0621) → Pinned rollup to ^4.59.0 (CVE-2026-27606)
Post summary
The post announces dependency hardening by pinning packages to mitigate several CVEs, effectively providing a patch/workaround.
🔴 Nodejs, Improper Signature Verification, #CVE-2025-65945 (High) https://dailycve.com/nodejs-improper-signature-verification-cve-2025-65945-high/
Post summary
The tweet announces the discovery of a new Node.js vulnerability (CVE-2025-65945) related to improper signature verification, indicating it is high severity.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | auth0 | node-jws | - | node.js | - |
| App | auth0 | node-jws | 4.0.0 | node.js | - |