CVE-2025-45770

jwt v5.4.3 was discovered to contain weak encryption

High · published July 31, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00137 · 2.8th percentile
Published
2025-07-31T00:00Z
EPSS history
Timeline
  • 31 JUL 00:00Z
    jwt v5.4.3 was discovered to contain weak encryption
    cvelistv5