Threats tagged 'ghsa-fwg2-gr34-q3w8'

SurrealDB versions prior to 3.1.0 silently downgrade the ES512 JWT algorithm to ES384 due to a limitation in the underlying jsonwebtoken crate, causing authentication handshake failures when using the correct P-521 key type. This does not allow token forgery or compromise data integrity, but results in failed authentication when external systems expect true ES512 signatures. The issue is fixed in SurrealDB 3.1.0, which blocks use of ES512 with clear errors and deprecation warnings. Users should update to 3.1.0 or later and reconfigure JWT access methods to supported algorithms such as ES384.