Threats affecting pkg:npm/jose

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.9	EPSS <0.1%	CVE-2026-65626RSAES-PKCS1-v1_5 decryption · Bleichenbacher Padding Oracle Medium5.9EPSS <0.1%2026-10-31GCVE DatabaseCVE-2026-65626 CVE-2026-65626 is a vulnerability involving a Bleichenbacher padding oracle attack in the RSAES-PKCS1-v1_5 decryption implementation within the jose library, specifically affecting version 3.0. The vulnerability allows an attacker to exploit the padding oracle to potentially decrypt RSA-encrypted messages without the private key. No CVSS score or detailed impact information is provided. EPSS <0.1%Report on CVE-2026-65626 Vulnerability Microsoft Security Response Center CWE-203 #microsoft-security-response-ce	GCVE Database	2026-10-31
High	7.4	EPSS <0.1%	CVE-2026-65629Microsoft · Weak PBKDF2 parameters for password-encrypted private-key export in jose High7.4EPSS <0.1%2026-10-31GCVE DatabaseCVE-2026-65629 This vulnerability involves weak PBKDF2 parameters used for password-encrypted private-key export in the jose library version 3.0. Weak PBKDF2 parameters can reduce the effectiveness of password-based key derivation, potentially making it easier for attackers to recover passwords from encrypted private keys. EPSS <0.1%Report on CVE-2026-65629 Vulnerability Microsoft Security Response Center CWE-916 #microsoft-security-response-ce	GCVE Database	2026-10-31

Page 1 of 1