ruby-jwt vulnerabilities

CVEs whose affected-version data names the ruby-jwt package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-45363Critical· 9.1

2mo ago

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', paylo…

▾ Midnightjwt · ruby-jwtEPSS 0.26%via NVD