Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The following major versions are currently supported with security updates.

Version	End-of-life
v6.x	TBD
v5.x	2026-04-30
v4.x	2026-04-30
v2.x	2026-04-30

End-of-life for the current release will be determined prior to the release of its successor.

Reporting a Vulnerability

You should report vulnerabilities using the Github UI or via email [email protected]

Resource exhaustion via specifically crafted JWE with compressed plaintext
GHSA-hhhv-q57g-882q published Mar 7, 2024 by panva

Moderate
Resource exhaustion via specifically crafted JWE
GHSA-jv3g-j58f-9mq9 published Sep 6, 2022 by panva

Moderate
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
GHSA-4v4g-726h-xvfv published Apr 15, 2021 by panva

Moderate
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
GHSA-94hh-pjjg-rwmr published Apr 15, 2021 by panva

Moderate
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime
GHSA-rvcw-f68w-8h8h published Apr 15, 2021 by panva

Moderate
Padding Oracle Attack due to Observable Timing Discrepancy in jose
GHSA-58f5-hfqc-jgch published Apr 15, 2021 by panva

Moderate

Learn more about advisories related to panva/jose in the GitHub Advisory Database