CVE-2022-23529: Insecure input validation in jwt.verify function

A high-severity security flaw has been disclosed in the open source jsonwebtoken (JWT) library that, if successfully exploited, could lead to remote code execution on a target server. "By exploiting this vulnerability, attackers could achieve remote code execution (RCE) on a server verifying a maliciously crafted JSON web token (JWT) request," Palo Alto Networks Unit 42 researcher Artur Oleyarsh

The JsonWebToken package plays a big role in the authentication and authorization functionality for many applications.

# Overview For versions `<=8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) of the `jwt.verify()` function, they can gain remote code execution (RCE). # Am I affected? You are affected only if you allow untrusted entities to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. # How do I fix it? Update to version 9.0.0 # Will the fix impact my users? The fix has no impact on end users. # Credits [Palo Alto Networks](https://www.paloaltonetworks.com/)