Vulnerability-Lookup

GHSA-3J8V-CGW4-2G6Q

Vulnerability from github – Published: 2026-04-09 16:41 – Updated: 2026-04-09 19:05

Summary

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Details

Impact

Using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided.

Such modifiers are: - /g : Global matching - /y : Sticky matching

This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern, leading to: - Intermittent user authentication failures - Potential retry storms in applications - Operational monitoring alerts

Affected Configurations

This vulnerability ONLY affects applications that:

Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options
Use stateful RegExp modifiers such a /g or /y

Example: allowedAud: /abc/g ← IMPACTED Example: allowedAud: "/abc/" ← SAFE

Not Affected

Applications using string patterns for audience validation (most common)
Applications using RegExp patterns without stateful modifiers

Assessment Guide

To determine if you're affected:

Check if allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options use RegExp objects (/pattern/ or new RegExp()) If yes, review the pattern for stateful modifiers like /g, /y If no RegExp usage or no stateful modifiers, you are NOT affected

Mitigation Options

While a fix will be coming in the next version of the package you can take steps to mitigate the issue immediately by removing any such modifiers (/g, /y) from the regex.

Summary

fast-jwt accepts RegExp for allowedAud, allowedIss, allowedSub, allowedJti, and allowedNonce.

If the provided regular expression uses the g (global) or y (sticky) flag, verification becomes non-deterministic: the same valid token alternates between acceptance and rejection across successive calls.

This occurs because RegExp.prototype.test() is stateful when g/y is set (it mutates lastIndex), and fast-jwt reuses the same RegExp object without resetting lastIndex.

Affected component

src/verifier.js

ensureStringClaimMatcher() returns the RegExp object directly.

validateClaimValues() performs repeated a.test(v) calls without resetting lastIndex.

Impact

Logical denial-of-service / authentication flapping.

A valid signed JWT can be intermittently rejected.

Causes unpredictable authentication outcomes across repeated verification calls.

Can trigger retry storms and cascading failures in API gateways and authentication middleware.

Affects any deployment that configures allowed* using RegExp and includes g or y flags.

Root cause

validateClaimValues() uses: allowed.some(a => a.test(v))

When a is a RegExp with g or y, a.test() mutates a.lastIndex.

Subsequent calls against the same input can return different results.

Proof of concept

Environment

fast-jwt: 6.1.0 (repo HEAD)
Node.js: v24.13.1

PoC const { createSigner, createVerifier } = require('fast-jwt')

const sign = createSigner({ key: 'secret' }) const token = sign({ aud: 'admin', iss: 'issuer' })

run('allowedAud global regex', { allowedAud: /^admin$/g }) run('allowedIss global regex', { allowedIss: /^issuer$/g }) run('control (non-global regex)', { allowedAud: /^admin$/ })

Observed behavior

allowedAud with /g alternates PASS/FAIL across calls
allowedIss with /g alternates PASS/FAIL across calls
control regex (no g/y) is deterministic and always PASS

Expected behavior

Validation must be deterministic.

The same token under the same verifier configuration must always yield the same decision.

Suggested fix (minimal and safe)

Wrap RegExp matchers inside ensureStringClaimMatcher() to reset lastIndex before calling test(): if (r instanceof RegExp) { return { test: v => { r.lastIndex = 0; return r.test(v) } } }

This preserves semantics for non-global regexes, makes g/y deterministic, and avoids changes in the rest of the verifier logic.

Security classification

Logical DoS / authentication reliability failure.

This can be weaponized to produce production outages via retry storms and auth instability.

Why this is not “misuse”

The library explicitly accepts RegExp for allowed* claim validation.
The behavior difference is caused by internal state mutation of RegExp.test().
The same token, same verifier config, same runtime yields different outcomes.
Security decisions must be deterministic; non-determinism at the verification layer is a correctness flaw.
Consumers cannot reliably defend against this unless the library normalizes matcher state.

Notes

Affects allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce equally (shared matcher logic).
Independent from the previously reported ReDoS; this is a determinism and correctness failure that can still produce production DoS effects.

PoC Code: 'use strict'

/* * PoC: Stateful RegExp flags (g/y) cause non-deterministic allowed-claim validation * fast-jwt reuses the same RegExp object; RegExp.test() mutates lastIndex when g/y is set. * * This script prints a human-readable log AND writes evidence to JSON. * * Usage: * node poc_regex_state_evidence.js /

const fs = require('node:fs') const path = require('node:path') const { createSigner, createVerifier } = require('fast-jwt')

const OUT_JSON = path.join(process.cwd(), 'evidence-regex-stateful-fastjwt.json') const OUT_LOG = path.join(process.cwd(), 'evidence-regex-stateful-fastjwt.log')

// Make a stable, valid token const sign = createSigner({ key: 'secret' }) const token = sign({ aud: 'admin', iss: 'issuer', sub: 'subject', jti: 'id-123', nonce: 'nonce-xyz' })

function runCase(name, verifierOpts, iterations = 12) { const verify = createVerifier({ key: 'secret', ...verifierOpts })

const results = [] for (let i = 0; i < iterations; i++) { try { verify(token) results.push({ i, ok: true }) } catch (e) { results.push({ i, ok: false, code: e.code || null, message: e.message || String(e) }) } }

return results }

function summarize(results) { const seq = results.map(r => (r.ok ? 'PASS' : 'FAIL')).join(' ') const pass = results.filter(r => r.ok).length const fail = results.length - pass return { pass, fail, seq } }

function printCase(name, opts, results) { const s = summarize(results) const lines = [] lines.push(== ${name}) lines.push(opts: ${JSON.stringify(opts)}) lines.push(PASS=${s.pass} FAIL=${s.fail}) lines.push(sequence: ${s.seq}) lines.push('') return lines.join('\n') }

function main() { const meta = { poc: 'stateful-regexp-allowed-claims', package: 'fast-jwt', node: process.version, timestamp: new Date().toISOString(), note: 'RegExp.test is stateful when g/y flags are set; lastIndex mutation causes alternating PASS/FAIL.' }

// Cases: g/y should flap, control should be stable const cases = [ { name: 'allowedAud with global RegExp /g (expected: flapping)', opts: { allowedAud: /^admin$/g } }, { name: 'allowedAud with sticky RegExp /y (expected: flapping)', opts: { allowedAud: /^admin$/y } }, { name: 'allowedIss with global RegExp /g (expected: flapping)', opts: { allowedIss: /^issuer$/g } }, { name: 'allowedSub with global RegExp /g (expected: flapping)', opts: { allowedSub: /^subject$/g } }, { name: 'allowedJti with global RegExp /g (expected: flapping)', opts: { allowedJti: /^id-123$/g } }, { name: 'allowedNonce with global RegExp /g (expected: flapping)', opts: { allowedNonce: /^nonce-xyz$/g } }, { name: 'CONTROL: allowedAud with non-global RegExp (expected: stable PASS)', opts: { allowedAud: /^admin$/ } } ]

const evidence = { meta, token: { alg: 'HS256 (autodetected by fast-jwt)', signed: true, jwt: token }, cases: [] }

let log = '' for (const c of cases) { const results = runCase(c.name, c.opts, 12) const s = summarize(results)

evidence.cases.push({
  name: c.name,
  opts: c.opts,
  iterations: results.length,
  pass: s.pass,
  fail: s.fail,
  sequence: s.seq,
  results
})

log += printCase(c.name, c.opts, results)

}

fs.writeFileSync(OUT_JSON, JSON.stringify(evidence, null, 2)) fs.writeFileSync(OUT_LOG, log)

console.log(log) console.log([+] Wrote JSON evidence: ${OUT_JSON}) console.log([+] Wrote LOG evidence : ${OUT_LOG}) }

main()

Output: PS C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt> node .\poc_regex_state_evidence.js == allowedAud with global RegExp /g (expected: flapping) opts: {"allowedAud":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == allowedAud with sticky RegExp /y (expected: flapping) opts: {"allowedAud":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == allowedIss with global RegExp /g (expected: flapping) opts: {"allowedIss":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == allowedSub with global RegExp /g (expected: flapping) opts: {"allowedSub":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == allowedJti with global RegExp /g (expected: flapping) opts: {"allowedJti":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == allowedNonce with global RegExp /g (expected: flapping) opts: {"allowedNonce":{}} PASS=6 FAIL=6 sequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL == CONTROL: allowedAud with non-global RegExp (expected: stable PASS) opts: {"allowedAud":{}} PASS=12 FAIL=0 sequence: PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS

[+] Wrote JSON evidence: C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt\evidence-regex-stateful-fastjwt.json [+] Wrote LOG evidence : C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt\evidence-regex-stateful-fastjwt.log PS C:\Users\Franciny Rojas\Desktop\crypto-research\fast-jwt>

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-jwt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440",
      "CWE-697"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-09T16:41:20Z",
    "nvd_published_at": "2026-04-09T16:16:27Z",
    "severity": "MODERATE"
  },
  "details": "## Impact\n\nUsing certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided.\n\nSuch modifiers are:\n- /g : Global matching\n- /y : Sticky matching\n\nThis does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes **50% of valid authentication requests to fail** in an alternating pattern, leading to:\n  - Intermittent user authentication failures\n  - Potential retry storms in applications\n  - Operational monitoring alerts\n\n## Affected Configurations\n\n### This vulnerability ONLY affects applications that:\n\n- Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options\n- Use stateful RegExp modifiers such a /g or /y\n\nExample: allowedAud: /abc/g \u2190 IMPACTED\nExample: allowedAud: \"/abc/\" \u2190 SAFE\n\n### Not Affected\n\n- Applications using string patterns for audience validation (most common)\n- Applications using RegExp patterns without stateful modifiers\n\n### Assessment Guide\nTo determine if you\u0027re affected:\n\nCheck if  allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options use RegExp objects (/pattern/ or new RegExp())\nIf yes, review the pattern for stateful modifiers like /g, /y\nIf no RegExp usage or no stateful modifiers, you are NOT affected\n\n## Mitigation Options\nWhile a fix will be coming in the next version of the package you can take steps to mitigate the issue immediately by removing any such modifiers (/g, /y) from the regex.\n\n---\n\nSummary\n\nfast-jwt accepts RegExp for allowedAud, allowedIss, allowedSub, allowedJti, and allowedNonce.\n\nIf the provided regular expression uses the g (global) or y (sticky) flag, verification becomes non-deterministic: the same valid token alternates between acceptance and rejection across successive calls.\n\nThis occurs because RegExp.prototype.test() is stateful when g/y is set (it mutates lastIndex), and fast-jwt reuses the same RegExp object without resetting lastIndex.\n\n\nAffected component\n\nsrc/verifier.js\n\nensureStringClaimMatcher() returns the RegExp object directly.\n\nvalidateClaimValues() performs repeated a.test(v) calls without resetting lastIndex.\n\n\nImpact\n\nLogical denial-of-service / authentication flapping.\n\nA valid signed JWT can be intermittently rejected.\n\nCauses unpredictable authentication outcomes across repeated verification calls.\n\nCan trigger retry storms and cascading failures in API gateways and authentication middleware.\n\nAffects any deployment that configures allowed* using RegExp and includes g or y flags.\n\n\nRoot cause\n\nvalidateClaimValues() uses: allowed.some(a =\u003e a.test(v))\n\n\nWhen `a` is a RegExp with g or y, `a.test()` mutates `a.lastIndex`.\n\nSubsequent calls against the same input can return different results.\n\n\nProof of concept\n\nEnvironment\n\n- fast-jwt: 6.1.0 (repo HEAD)\n- Node.js: v24.13.1\n\nPoC\nconst { createSigner, createVerifier } = require(\u0027fast-jwt\u0027)\n\nconst sign = createSigner({ key: \u0027secret\u0027 })\nconst token = sign({ aud: \u0027admin\u0027, iss: \u0027issuer\u0027 })\n\nfunction run(name, opts) {\nconst verify = createVerifier({ key: \u0027secret\u0027, ...opts })\nconsole.log(\u0027\\n==\u0027, name)\nfor (let i = 0; i \u003c 8; i++) {\ntry { verify(token); console.log(i, \u0027PASS\u0027) }\ncatch (e) { console.log(i, \u0027FAIL\u0027, e.code || e.message) }\n}\n}\n\nrun(\u0027allowedAud global regex\u0027, { allowedAud: /^admin$/g })\nrun(\u0027allowedIss global regex\u0027, { allowedIss: /^issuer$/g })\nrun(\u0027control (non-global regex)\u0027, { allowedAud: /^admin$/ })\n\n\n\nObserved behavior\n\n- allowedAud with `/g` alternates PASS/FAIL across calls\n- allowedIss with `/g` alternates PASS/FAIL across calls\n- control regex (no g/y) is deterministic and always PASS\n\n\nExpected behavior\n\nValidation must be deterministic.\n\nThe same token under the same verifier configuration must always yield the same decision.\n\n\nSuggested fix (minimal and safe)\n\nWrap RegExp matchers inside ensureStringClaimMatcher() to reset lastIndex before calling test():\nif (r instanceof RegExp) {\nreturn { test: v =\u003e { r.lastIndex = 0; return r.test(v) } }\n}\n\n\nThis preserves semantics for non-global regexes, makes g/y deterministic, and avoids changes in the rest of the verifier logic.\n\n\nSecurity classification\n\nLogical DoS / authentication reliability failure.\n\nThis can be weaponized to produce production outages via retry storms and auth instability.\n\n\nWhy this is not \u201cmisuse\u201d\n\n- The library explicitly accepts RegExp for allowed* claim validation.\n- The behavior difference is caused by internal state mutation of RegExp.test().\n- The same token, same verifier config, same runtime yields different outcomes.\n- Security decisions must be deterministic; non-determinism at the verification layer is a correctness flaw.\n- Consumers cannot reliably defend against this unless the library normalizes matcher state.\n\n\nNotes\n\n- Affects allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce equally (shared matcher logic).\n- Independent from the previously reported ReDoS; this is a determinism and correctness failure that can still produce production DoS effects.\n\n\nPoC Code:\n\u0027use strict\u0027\n\n/**\n * PoC: Stateful RegExp flags (g/y) cause non-deterministic allowed-claim validation\n * fast-jwt reuses the same RegExp object; RegExp.test() mutates lastIndex when g/y is set.\n *\n * This script prints a human-readable log AND writes evidence to JSON.\n *\n * Usage:\n *   node poc_regex_state_evidence.js\n */\n\nconst fs = require(\u0027node:fs\u0027)\nconst path = require(\u0027node:path\u0027)\nconst { createSigner, createVerifier } = require(\u0027fast-jwt\u0027)\n\nconst OUT_JSON = path.join(process.cwd(), \u0027evidence-regex-stateful-fastjwt.json\u0027)\nconst OUT_LOG  = path.join(process.cwd(), \u0027evidence-regex-stateful-fastjwt.log\u0027)\n\n// Make a stable, valid token\nconst sign = createSigner({ key: \u0027secret\u0027 })\nconst token = sign({\n  aud: \u0027admin\u0027,\n  iss: \u0027issuer\u0027,\n  sub: \u0027subject\u0027,\n  jti: \u0027id-123\u0027,\n  nonce: \u0027nonce-xyz\u0027\n})\n\nfunction runCase(name, verifierOpts, iterations = 12) {\n  const verify = createVerifier({ key: \u0027secret\u0027, ...verifierOpts })\n\n  const results = []\n  for (let i = 0; i \u003c iterations; i++) {\n    try {\n      verify(token)\n      results.push({ i, ok: true })\n    } catch (e) {\n      results.push({ i, ok: false, code: e.code || null, message: e.message || String(e) })\n    }\n  }\n\n  return results\n}\n\nfunction summarize(results) {\n  const seq = results.map(r =\u003e (r.ok ? \u0027PASS\u0027 : \u0027FAIL\u0027)).join(\u0027 \u0027)\n  const pass = results.filter(r =\u003e r.ok).length\n  const fail = results.length - pass\n  return { pass, fail, seq }\n}\n\nfunction printCase(name, opts, results) {\n  const s = summarize(results)\n  const lines = []\n  lines.push(`== ${name}`)\n  lines.push(`opts: ${JSON.stringify(opts)}`)\n  lines.push(`PASS=${s.pass} FAIL=${s.fail}`)\n  lines.push(`sequence: ${s.seq}`)\n  lines.push(\u0027\u0027)\n  return lines.join(\u0027\\n\u0027)\n}\n\nfunction main() {\n  const meta = {\n    poc: \u0027stateful-regexp-allowed-claims\u0027,\n    package: \u0027fast-jwt\u0027,\n    node: process.version,\n    timestamp: new Date().toISOString(),\n    note: \u0027RegExp.test is stateful when g/y flags are set; lastIndex mutation causes alternating PASS/FAIL.\u0027\n  }\n\n  // Cases: g/y should flap, control should be stable\n  const cases = [\n    {\n      name: \u0027allowedAud with global RegExp /g (expected: flapping)\u0027,\n      opts: { allowedAud: /^admin$/g }\n    },\n    {\n      name: \u0027allowedAud with sticky RegExp /y (expected: flapping)\u0027,\n      opts: { allowedAud: /^admin$/y }\n    },\n    {\n      name: \u0027allowedIss with global RegExp /g (expected: flapping)\u0027,\n      opts: { allowedIss: /^issuer$/g }\n    },\n    {\n      name: \u0027allowedSub with global RegExp /g (expected: flapping)\u0027,\n      opts: { allowedSub: /^subject$/g }\n    },\n    {\n      name: \u0027allowedJti with global RegExp /g (expected: flapping)\u0027,\n      opts: { allowedJti: /^id-123$/g }\n    },\n    {\n      name: \u0027allowedNonce with global RegExp /g (expected: flapping)\u0027,\n      opts: { allowedNonce: /^nonce-xyz$/g }\n    },\n    {\n      name: \u0027CONTROL: allowedAud with non-global RegExp (expected: stable PASS)\u0027,\n      opts: { allowedAud: /^admin$/ }\n    }\n  ]\n\n  const evidence = {\n    meta,\n    token: {\n      alg: \u0027HS256 (autodetected by fast-jwt)\u0027,\n      signed: true,\n      jwt: token\n    },\n    cases: []\n  }\n\n  let log = \u0027\u0027\n  for (const c of cases) {\n    const results = runCase(c.name, c.opts, 12)\n    const s = summarize(results)\n\n    evidence.cases.push({\n      name: c.name,\n      opts: c.opts,\n      iterations: results.length,\n      pass: s.pass,\n      fail: s.fail,\n      sequence: s.seq,\n      results\n    })\n\n    log += printCase(c.name, c.opts, results)\n  }\n\n  fs.writeFileSync(OUT_JSON, JSON.stringify(evidence, null, 2))\n  fs.writeFileSync(OUT_LOG, log)\n\n  console.log(log)\n  console.log(`[+] Wrote JSON evidence: ${OUT_JSON}`)\n  console.log(`[+] Wrote LOG evidence : ${OUT_LOG}`)\n}\n\nmain()\n\n\nOutput:\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e node .\\poc_regex_state_evidence.js\n== allowedAud with global RegExp /g (expected: flapping)\nopts: {\"allowedAud\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedAud with sticky RegExp /y (expected: flapping)\nopts: {\"allowedAud\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedIss with global RegExp /g (expected: flapping)\nopts: {\"allowedIss\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedSub with global RegExp /g (expected: flapping)\nopts: {\"allowedSub\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedJti with global RegExp /g (expected: flapping)\nopts: {\"allowedJti\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedNonce with global RegExp /g (expected: flapping)\nopts: {\"allowedNonce\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== CONTROL: allowedAud with non-global RegExp (expected: stable PASS)\nopts: {\"allowedAud\":{}}\nPASS=12 FAIL=0\nsequence: PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS\n\n[+] Wrote JSON evidence: C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-regex-stateful-fastjwt.json\n[+] Wrote LOG evidence : C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-regex-stateful-fastjwt.log\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e",
  "id": "GHSA-3j8v-cgw4-2g6q",
  "modified": "2026-04-09T19:05:11Z",
  "published": "2026-04-09T16:41:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35040"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nearform/fast-jwt/pull/593"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nearform/fast-jwt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nearform/fast-jwt/releases/tag/v6.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)"
}

GHSA-3R76-7GPF-JQ4W

Vulnerability from github – Published: 2024-07-18 21:30 – Updated: 2024-07-18 21:30

Details

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their intended permissions.

Severity

3.9 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-38806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-18T19:15:12Z",
    "severity": "LOW"
  },
  "details": "Failure to properly synchronize user\u0027s permissions in UAA in Cloud Foundry Foundation  v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 ,\n potentially resulting in users retaining access rights they should not \nhave.  This can allow them to perform operations beyond their intended \npermissions.",
  "id": "GHSA-3r76-7gpf-jq4w",
  "modified": "2024-07-18T21:30:37Z",
  "published": "2024-07-18T21:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38806"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudfoundry.org/blog/cve-2024-38806-uaa-failure-to-remove-shadow-users-access"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-53WR-CX66-4578

Vulnerability from github – Published: 2023-09-08 12:30 – Updated: 2024-04-04 07:34

Details

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions.

Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences.

The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions.

The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.

The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.

As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap:

OPENSSL_ia32cap=:~0x200000

The FIPS provider is not affected by this issue.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-4807"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-08T12:15:08Z",
    "severity": "HIGH"
  },
  "details": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications on the\nWindows 64 platform when running on newer X86_64 processors supporting the\nAVX512-IFMA instructions.\n\nImpact summary: If in an application that uses the OpenSSL library an attacker\ncan influence whether the POLY1305 MAC algorithm is used, the application\nstate might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\nnot save the contents of non-volatile XMM registers on Windows 64 platform\nwhen calculating the MAC of data larger than 64 bytes. Before returning to\nthe caller all the XMM registers are set to zero rather than restoring their\nprevious content. The vulnerable code is used only on newer x86_64 processors\nsupporting the AVX512-IFMA instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However given the contents of the registers are just zeroized so\nthe attacker cannot put arbitrary values inside, the most likely consequence,\nif any, would be an incorrect result of some application dependent\ncalculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\ncipher is used by the server. This implies that server applications using\nOpenSSL can be potentially impacted. However we are currently not aware of\nany concrete application that would be affected by this issue therefore we\nconsider this a Low severity security issue.\n\nAs a workaround the AVX512-IFMA instructions support can be disabled at\nruntime by setting the environment variable OPENSSL_ia32cap:\n\n   OPENSSL_ia32cap=:~0x200000\n\nThe FIPS provider is not affected by this issue.",
  "id": "GHSA-53wr-cx66-4578",
  "modified": "2024-04-04T07:34:05Z",
  "published": "2023-09-08T12:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4807"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230921-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.openssl.org/news/secadv/20230908.txt"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/174593/OpenSSL-Security-Advisory-20230908.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/08/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/08/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-54R2-W853-7RGW

Vulnerability from github – Published: 2024-09-11 18:31 – Updated: 2024-10-03 03:31

Details

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

5.6 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L/AU:N/R:U/V:D/RE:M/U:Amber

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-8690"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-11T17:15:14Z",
    "severity": "MODERATE"
  },
  "details": "A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.",
  "id": "GHSA-54r2-w853-7rgw",
  "modified": "2024-10-03T03:31:10Z",
  "published": "2024-09-11T18:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8690"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2024-8690"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-5HQ9-5R78-2GJH

Vulnerability from github – Published: 2025-07-10 15:31 – Updated: 2025-07-10 18:45

Summary

LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class

Details

A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to but excluding version 0.12.41, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "llama-index"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "llama-index-readers-docugami"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6211"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-10T18:45:04Z",
    "nvd_published_at": "2025-07-10T13:15:23Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to but excluding version 0.12.41, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.",
  "id": "GHSA-5hq9-5r78-2gjh",
  "modified": "2025-07-10T18:45:04Z",
  "published": "2025-07-10T15:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6211"
    },
    {
      "type": "WEB",
      "url": "https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/run-llama/llama_index"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class "
}

GHSA-5P85-47CF-3663

Vulnerability from github – Published: 2026-09-29 18:31 – Updated: 2026-09-30 21:31

Details

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received.

Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack.

CWE: CWE-440: Expected Behavior Violation

Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed.

The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC.

FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-35191"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T16:17:07Z",
    "severity": "LOW"
  },
  "details": "Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL\u0027s QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack.  If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE.",
  "id": "GHSA-5p85-47cf-3663",
  "modified": "2026-09-30T21:31:58Z",
  "published": "2026-09-29T18:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35191"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a"
    },
    {
      "type": "WEB",
      "url": "https://openssl-library.org/news/secadv/20260929.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-648W-89VF-3PFC

Vulnerability from github – Published: 2026-03-03 15:31 – Updated: 2026-08-10 18:32

Details

A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.This issue affects Fireware OS 12.0 up to and including 12.11.7, 12.5.9 up to and including 12.5.16, and 2025.1 up to and including 2026.1.1.

Severity

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-3344"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-03T14:15:57Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.This issue affects Fireware OS 12.0 up to and including 12.11.7, 12.5.9 up to and including 12.5.16, and 2025.1 up to and including 2026.1.1.",
  "id": "GHSA-648w-89vf-3pfc",
  "modified": "2026-08-10T18:32:00Z",
  "published": "2026-03-03T15:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3344"
    },
    {
      "type": "WEB",
      "url": "https://psirt.watchguard.com/CVE-2026-3344"
    },
    {
      "type": "WEB",
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00005"
    },
    {
      "type": "WEB",
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6626-64RF-2CVV

Vulnerability from github – Published: 2022-05-24 17:03 – Updated: 2024-04-04 02:43

Details

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-5061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-287",
      "CWE-440"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-12T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.",
  "id": "GHSA-6626-64rf-2cvv",
  "modified": "2024-04-04T02:43:10Z",
  "published": "2022-05-24T17:03:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5061"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0849"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7G9J-G5JG-3VV3

Vulnerability from github – Published: 2024-01-24 20:53 – Updated: 2025-07-28 15:56

Summary

Unauthenticated Nonce Increment in snow

Details

Impact

There was a logic bug where unauthenticated payloads could still cause a nonce increment in snow's internal state. For an attacker with the ability to inject packets into the channel Noise is talking over, this allows a denial-of-service type attack which could prevent communication as it causes the sending and receiving side to be expecting different nonce values than would arrive.

Note that this only affects those who are using the stateful TransportState, not those using StatelessTransportState.

Patches

This has been patched in version 0.9.5, and all users are recommended to update.

References

There will be a more formal report of this in the near future.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "snow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-58265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-440"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-24T20:53:48Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nThere was a logic bug where unauthenticated payloads could still cause a nonce increment in snow\u0027s internal state. For an attacker with the ability to inject packets into the channel Noise is talking over, this allows a denial-of-service type attack which could prevent communication as it causes the sending and receiving side to be expecting different nonce values than would arrive.\n\nNote that this only affects those who are using the stateful `TransportState`, not those using `StatelessTransportState`.\n\n### Patches\nThis has been patched in version 0.9.5, and all users are recommended to update.\n\n### References\nThere will be a more formal report of this in the near future.",
  "id": "GHSA-7g9j-g5jg-3vv3",
  "modified": "2025-07-28T15:56:29Z",
  "published": "2024-01-24T20:53:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mcginty/snow/security/advisories/GHSA-7g9j-g5jg-3vv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58265"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mcginty/snow/commit/12e8ae55547ae297d5f70599e5c884ea891303eb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mcginty/snow"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0011.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unauthenticated Nonce Increment in snow"
}

GHSA-8988-9CW3-XX77

Vulnerability from github – Published: 2026-09-30 14:46 – Updated: 2026-09-30 14:46

Summary

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Details

Impact

urllib3 supports configuring TLS independently for an HTTPS proxy and the target server.

proxy_ssl_context, proxy_assert_hostname, and proxy_assert_fingerprint configure the TLS connection to the proxy. ssl_context and the other target-specific TLS parameters configure the connection to the target server.

In urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:

Ignore proxy_ssl_context and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.
Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.
Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.

In particular, configuring cert_reqs="CERT_NONE" for a target server could overwrite the verify_mode of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.

An attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker's certificate. This may occur, for example, when the target server's trust or identity policy is incorrectly applied to the proxy connection.

When HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.

A TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client's identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.

In CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.

Affected Usages

Code using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.

1. The target SSL context is used for an HTTPS forwarding proxy

HTTPS requests are forwarded through an HTTPS proxy with use_forwarding_for_https=True, and proxy_ssl_context is configured for the proxy.

urllib3 may ignore proxy_ssl_context and use the target server's ssl_context for the proxy TLS handshake. The proxy may therefore be verified using the target server's trust and certificate policy instead of the policy explicitly configured for the proxy.

2. The target verification policy overrides the proxy policy

An HTTPS proxy is configured with proxy_ssl_context, while the target server uses a different certificate-verification policy.

urllib3 may apply the target server's cert_reqs value to the proxy SSL context. For example, setting cert_reqs="CERT_NONE" for the target server may also disable certificate verification for the HTTPS proxy, even when proxy_ssl_context was configured to require verification.

This issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.

3. A mutated proxy SSL context is reused

The same SSL context is reused as proxy_ssl_context across multiple connections, and certificate verification is disabled for one target server.

urllib3 may modify the proxy SSL context's verify_mode in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.

4. Target-specific TLS identity or credentials are applied to the proxy

HTTPS requests are forwarded through an HTTPS proxy with use_forwarding_for_https=True, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.

urllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:

send SNI intended for the target server to the proxy;
verify the proxy using a hostname or certificate fingerprint intended for the target server; or
present a TLS client certificate intended for the target server to the proxy.

Code connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.

Remediation

Upgrade to urllib3 2.8.0 or later.

urllib3 2.8.0 independently applies the explicitly configured proxy_ssl_context and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.

For backward compatibility, when an HTTPS proxy is used with use_forwarding_for_https=True and proxy_ssl_context is not provided, urllib3 2.8.0 continues to use ssl_context for the TLS connection to the proxy. This configuration emits a FutureWarning. In urllib3 3.0, passing ssl_context with use_forwarding_for_https=True for an HTTPS proxy will raise an error. Applications should use proxy_ssl_context to configure TLS for an HTTPS forwarding proxy.

The fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.

Severity

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "urllib3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.26.0"
            },
            {
              "fixed": "2.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-97687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-440"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T14:46:04Z",
    "nvd_published_at": "2026-09-29T16:17:18Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.\n\nIn urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:\n\n1. Ignore `proxy_ssl_context` and use the target server\u0027s SSL context for the TLS connection to an HTTPS forwarding proxy.\n2. Override the HTTPS proxy\u0027s certificate-verification policy with the target server\u0027s certificate-verification policy.\n3. Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.\n\nIn particular, configuring `cert_reqs=\"CERT_NONE\"` for a target server could overwrite the `verify_mode` of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.\n\nAn attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker\u0027s certificate. This may occur, for example, when the target server\u0027s trust or identity policy is incorrectly applied to the proxy connection.\n\nWhen HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.\n\nA TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client\u0027s identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.\n\nIn CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.\n\n## Affected Usages\n\nCode using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.\n\n### 1. The target SSL context is used for an HTTPS forwarding proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and `proxy_ssl_context` is configured for the proxy.\n\nurllib3 may ignore `proxy_ssl_context` and use the target server\u0027s `ssl_context` for the proxy TLS handshake. The proxy may therefore be verified using the target server\u0027s trust and certificate policy instead of the policy explicitly configured for the proxy.\n\n### 2. The target verification policy overrides the proxy policy\n\nAn HTTPS proxy is configured with `proxy_ssl_context`, while the target server uses a different certificate-verification policy.\n\nurllib3 may apply the target server\u0027s `cert_reqs` value to the proxy SSL context. For example, setting `cert_reqs=\"CERT_NONE\"` for the target server may also disable certificate verification for the HTTPS proxy, even when `proxy_ssl_context` was configured to require verification.\n\nThis issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.\n\n### 3. A mutated proxy SSL context is reused\n\nThe same SSL context is reused as `proxy_ssl_context` across multiple connections, and certificate verification is disabled for one target server.\n\nurllib3 may modify the proxy SSL context\u0027s `verify_mode` in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.\n\n### 4. Target-specific TLS identity or credentials are applied to the proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.\n\nurllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:\n\n- send SNI intended for the target server to the proxy;\n- verify the proxy using a hostname or certificate fingerprint intended for the target server; or\n- present a TLS client certificate intended for the target server to the proxy.\n\nCode connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.\n\n## Remediation\n\nUpgrade to urllib3 2.8.0 or later.\n\nurllib3 2.8.0 independently applies the explicitly configured `proxy_ssl_context` and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.\n\nFor backward compatibility, when an HTTPS proxy is used with `use_forwarding_for_https=True` and `proxy_ssl_context` is not provided, urllib3 2.8.0 continues to use `ssl_context` for the TLS connection to the proxy. This configuration emits a `FutureWarning`. In urllib3 3.0, passing `ssl_context` with `use_forwarding_for_https=True` for an HTTPS proxy will raise an error. Applications should use `proxy_ssl_context` to configure TLS for an HTTPS forwarding proxy.\n\nThe fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.",
  "id": "GHSA-8988-9cw3-xx77",
  "modified": "2026-09-30T14:46:04Z",
  "published": "2026-09-30T14:46:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97687"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/pull/5093"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/urllib3/urllib3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/releases/tag/2.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden"
}