Threats affecting pkg:hex/jose

CVE-2026-65630 is a timing side-channel vulnerability in the potatosalad jose library's pure-Erlang X25519 implementation. The vulnerability allows an attacker to recover a long-term X25519 private key by measuring decryption timing variations during scalar multiplication. This affects versions from 1.10.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.

The jose library versions from 1.0.0 up to but not including 1.11.13 improperly verify ECDSA JWS signatures by accepting signatures of non-canonical length. This signature malleability allows multiple distinct signature byte strings to verify as valid for the same token, defeating security controls that rely on signature uniqueness such as token revocation by hash, replay caches, and deduplication. The underlying cryptographic signature values (r, s) remain unchanged, so forging new payloads or impersonating signers is not possible. A fix is available in version 1.11.13.

CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.

CVE-2026-65629 is a vulnerability in the potatosalad jose library versions from 1.10.0 up to but not including 1.11.13. It involves the use of a password hash with insufficient computational effort during the export of password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both far below current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack to recover the private key.

CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.

CVE-2026-65627 is a vulnerability in potatosalad jose (erlang-jose) versions from 1.0.0 up to but not including 1.11.13. It involves improper handling of highly compressed data during decompression of JWE tokens, allowing a remote attacker to exhaust node memory by sending a crafted small JWE token. The decompression function does not limit output size, enabling data amplification that can crash the BEAM virtual machine and cause denial of service.

CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation of the jose_jwa_pkcs1 module in potatosalad jose. The vulnerability arises because the decryption function returns distinct error messages depending on padding validity and does not implement countermeasures to mask these differences. An attacker with access to the public RSA key and the ability to submit ciphertexts to a decryption endpoint can exploit this to recover plaintext or forge signatures through adaptive chosen-ciphertext attacks. This affects versions from 1.3.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.

CVE-2026-65625 is a vulnerability in the potatosalad jose library affecting versions from 1.2.0 up to but not including 1.11.13. The issue arises in the pure-Erlang AES-GCM fallback implementation where the authentication tag length is derived from attacker-supplied data without proper validation. This allows an attacker controlling a JWE token to truncate the authentication tag to as little as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. The vulnerability is fixed in version 1.11.13.