Repository navigation
Security: cdbattags/lua-resty-jwt
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
-
Token malleability: non-canonical compact serializations verify as the original tokenGHSA-v6j5-wh7j-2ggg published
Oct 7, 2026 by cdbattagsModerate -
Authentication bypass: forged JWE accepted when a public key is used as the PBES2 passwordGHSA-85rg-93pf-mg8c published
Oct 7, 2026 by cdbattagsCritical -
Algorithm confusion: RSA/EC public key accepted as HMAC secret when no algorithm whitelist is configuredGHSA-wm36-g7wp-x24w published
Oct 7, 2026 by cdbattagsHigh -
Unbounded PBES2 iteration count and JWE bypass of the algorithm whitelist allow CPU exhaustionGHSA-c526-qc23-r353 published
Oct 7, 2026 by cdbattagsHigh -
JWE AES-CBC-HMAC payload decrypted and claims validated before the authentication tag is checked (padding/decryption oracle)GHSA-4jwm-wqj5-pr89 published
Oct 7, 2026 by cdbattagsModerate -
Remote nginx worker crashes in the OpenSSL FFI layer (ES-signed token verified with an RSA key; x5c with an unloadable trusted-certs file)GHSA-8g6x-8538-rvj8 published
Oct 7, 2026 by cdbattagsHigh -
JWE AES-GCM authentication tag length not enforced, allowing forgery of encrypted tokensGHSA-gvf3-mm6g-94wp published
Oct 7, 2026 by cdbattagsModerate -
Authentication bypass via JWE header confusion in JWT verificationGHSA-9r96-mgg4-2jf3 published
Mar 1, 2026 by cdbattagsCritical
Learn more about advisories related to cdbattags/lua-resty-jwt in the GitHub Advisory Database