Tag: high

• Severity: HIGH
• CVE: CVE-2026-62374
• Ecosystems: npm, npm
• Packages: @sd-jwt/decode, @sd-jwt/core

## Summary

When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed `_sd` array, `@sd-jwt/decode` 0.19.0 does **not** reject the presentation. It silently drops the unmatched Disclosure and returns a **reduced claim set**, reporting success. The Issuer signature is untouched and valid.

This is a downgrade/omission primitive. A malicious or curious **holder** can present a tampered Disclosure and have the relying party receive *fewer* claims than the credential carries, with no error surfaced. Where the relying party does **not** enforce key binding, an **in-transit (on-path) attacker** can achieve the same by mangling one Disclosure’s bytes; where key binding **is** enforced, on-path tampering instead breaks the holder’s KB-JWT `sd_hash` binding (so it is rejected), and the downgrade is then exercisable by the key-bound holder — confirmed end-to-end with KB required.

Two distinct tampering inputs converge on the same silent-drop sink:

1. **Genuinely non-decodable Disclosure** (broken base64url -> bytes that are not valid UTF-8, e.g. an injected `0xF2` lead byte). RFC 9901 §7.1 step 3 / §4.2.1 require rejection. `@sd-jwt/decode` instead **lossy-decodes** it: the `TextDecoder`/`Buffer` path substitutes U+FFFD (REPLACEMENT CHARACTER) for the invalid byte and recovers a syntactically valid disclosure (the `salt` gains a U+FFFD, claim `family_name` = `”Smith”`). The recovered Disclosure then hashes to a digest **absent** from…

Source: GitHub Security Advisories · 2026-11-02

• Severity: HIGH
• CVE: CVE-2026-118772
• Ecosystems: npm, npm, npm
• Packages: joi, @hapi/joi, joi

### Summary

`Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

### Details

When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

“`js
const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ‘,’}]\\s*`);
// …
const emails = options.multiple ? value.split(regex) : [value];
“`

`String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values.

The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

“`js
const regex = new RegExp(`(?:(?

Source: GitHub Security Advisories · 2026-10-30

• Severity: HIGH
• CVE: CVE-2026-119202
• Ecosystems: npm, npm
• Packages: @hapi/content, content

### Summary

`Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.

### Details

`Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:

“`js
/([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;’”\s]+\'[\w-]*\'[^;\s]+)|(?:\”([^”]*)\”)|([^;\s]*))/g
“`

The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.

`@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.

The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.

“`js
/([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;’”\s]+\'[\w-]*\'[^;\s]+)|(?:\”([^”]*)\”)|([^;\s]*))|[^\=\*\s]+/g
“`

Every rel…

Source: GitHub Security Advisories · 2026-10-30