jose
6.2.13 · 20 Oct 2026MIT93.4M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for jose. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 6.2.13 | No known advisory | |
| 4.15.9 | 6 open advisories, worst moderate · last release Jul 2024, no longer updated |
- Moderatejose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintextGHSA-hhhv-q57g-882q · 7 Mar 2024
- 4.x4.0.0 – 4.15.4Fixed in 4.15.5
- 3.x3.0.0 – 3.20.4No fix on 3.x · move to 4.15.5
- 2.x2.0.0 – 2.0.6Fixed in 2.0.7
- 1.x and older0.0.0 – 1.28.2No fix, no longer updated · move to 2.0.7
- ModerateJOSE vulnerable to resource exhaustion via specifically crafted JWEGHSA-jv3g-j58f-9mq9 · 16 Sep 2022
- 4.x4.0.0 – 4.9.1Fixed in 4.9.2
- 3.x3.0.0 – 3.20.3Fixed in 3.20.4
- 2.x2.0.0 – 2.0.5Fixed in 2.0.6
- 1.x1.9.2 – 1.28.1Fixed in 1.28.2
- ModeratePadding Oracle Attack due to Observable Timing Discrepancy in joseGHSA-58f5-hfqc-jgch · 19 Apr 2021
- 3.x3.0.0 – 3.11.3Fixed in 3.11.4
- 2.x2.0.0 – 2.0.4Fixed in 2.0.5
- 1.x1.9.2 – 1.28.0Fixed in 1.28.1
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.