Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
Medium, CVSS 5.3amended

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

CVE-2024-28176GHSA-hhhv-q57g-882q

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (jose 4.15.5, 2.0.7; jose-node-esm-runtime 4.15.5; jose-node-cjs-runtime 4.15.5), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS
  • CVE-2024-28176: 2.10% estimated exploitation activity in the next 30 days; percentile 81.74 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This allows an adversary to exploit specific scenarios where the compression ratio becomes exceptionally high. As a result, the length of the JWE token, which is determined by the compressed content's size, can land below application-defined limits. In such cases, other existing application level mechanisms for preventing resource exhaustion may be rendered ineffective. Note that as per RFC 8725 compression of data SHOULD NOT be done before encryption, because such compressed data often reveals information about the plaintext. For this reason the v5.x major version of jose removed support for compressed payloads entirely and is therefore NOT affected by this advisory. Impact Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE…

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 2 · amended ·

    Amended from ghsa record GHSA-hhhv-q57g-882q

  2. Revision 1 · created ·

    Published from osv record GHSA-hhhv-q57g-882q

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-28176

Advisory: jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
IDs: CVE-2024-28176, GHSA-hhhv-q57g-882q
Record: https://patchnext.com/advisories/cve-2024-28176 (revision 2, source checked 26 Oct 2026, 12:30 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: jose 4.15.5, 2.0.7; jose-node-esm-runtime 4.15.5; jose-node-cjs-runtime 4.15.5. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm jose: affected >= 3.0.0, <= 4.15.4; < 2.0.7; fixed in 4.15.5, 2.0.7
- npm jose-node-esm-runtime: affected <= 4.15.4; fixed in 4.15.5
- npm jose-node-cjs-runtime: affected <= 4.15.4; fixed in 4.15.5

## Suggested inspection (read-only)
- `npm ls jose --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls jose-node-esm-runtime --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls jose-node-cjs-runtime --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on jose, jose-node-esm-runtime, jose-node-cjs-runtime.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-hhhv-q57g-882q (OSV record GHSA-hhhv-q57g-882q lists affected ranges: npm jose >=3.0.0 =0 =0 =0 <4.15.5 (fixed))
- Verified: https://github.com/advisories/GHSA-hhhv-q57g-882q (GitHub-reviewed advisory GHSA-hhhv-q57g-882q lists affected ranges: npm jose >=3.0.0 =0 =0 =0 <=4.15.4)

Commands are suggestions: review each one before running it.

Loading voting…