CVE-2025-65015: joserfc from 1.3.3 (inclusive), before 1.3.5 (exclusive), from 1.4.0 (inclusive), before 1.4.2 (exclusive), >= 1.3.3…

Affected technology

joserfc · from 1.3.3 (inclusive), before 1.3.5 (exclusive)
hsiaoming

joserfc · from 1.4.0 (inclusive), before 1.4.2 (exclusive)
hsiaoming

joserfc · >= 1.3.3, < 1.3.5, >= 1.4.0, < 1.4.2
authlib

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality and integrity impact as none; availability impact as high.