CVE-2026-65632 Details

A vulnerability in the jose library's handling of ECDSA JWS signatures (ES256, ES256K, ES384, and ES512) has been identified. The issue arises because the library does not properly validate the length of these signatures, allowing for non-canonical representations to be accepted during verification. Specifically, the verification function splits the signature based on its actual byte length, rather than adhering to the fixed length specified by RFC 7518. This flaw enables an attacker to prepend leading zero bytes to the R and S components of a signature, creating multiple distinct signature byte strings that all decode to the same underlying values. While this does not allow for forging new payloads or impersonating a signer, it undermines security mechanisms that rely on the uniqueness of tokens and signatures, such as token revocation, replay caches, and deduplication processes. The vulnerability affects jose versions 1.0.0 prior to 1.11.13.

Users can upgrade to jose version 1.11.13 or later, where this vulnerability has been fixed. If an upgrade is not possible, it is recommended to manually check the signature length before verification and to avoid relying on the uniqueness of signatures for security decisions.