https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T13:32:57.126549+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-25052 cnvd-2018-25052 2026-10-25T13:32:57.194243+00:00 cnvd-2018-25052 https://cve.radiocsirt.org/vuln/euvd-2026-167808 EUVD-2026-167808 2026-10-25T13:32:57.194280+00:00 EUVD-2026-167808 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16007 fkie_cve-2017-16007 2026-10-25T13:32:57.194295+00:00

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

 https://cve.radiocsirt.org/vuln/ghsa-rvj9-8cvx-3vq9 GHSA-rvj9-8cvx-3vq9 — Invalid Curve Attack in node-jose 2026-10-25T13:32:57.194324+00:00

Affected: npm: node-jose

Affected versions of `node-jose` are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

[Proof of Concept](https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae)

## Recommendation

Update to version 0.9.3 or later.

 https://cve.radiocsirt.org/vuln/gsd-2017-16007 gsd-2017-16007 2026-10-25T13:32:57.194350+00:00 gsd-2017-16007