Threats tagged 'ghsa-9pg5-8c7x-5hfx'

joserfc versions prior to 1.7.6 have a vulnerability in their compact JWS size guard. The library allocates attacker-controlled segments by splitting the input bytes before validating their size, causing an additional large memory allocation before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service due to memory exhaustion. A fix is available in version 1.7.6 that adds size checks before splitting the input.