Hex / PACKAGE INTELLIGENCE

jose

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.9

EEF-CVE-2026-65630Fix available

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.10.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65630

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.10.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9"
  ]
}

medium5.1

EEF-CVE-2026-65632Fix available

ECDSA signature length is not validated in jose, allowing signature malleability

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.0.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65632

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.0.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.1.1",
    "1.1.2",
    "1.1.3",
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.2.0",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.7.2",
    "1.7.3",
    "1.7.4",
    "1.7.5",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}

medium6.9

EEF-CVE-2026-65631Fix available

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.7.7 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65631

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.7.7"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}

high7.4

EEF-CVE-2026-65629Fix available

Weak PBKDF2 parameters for password-encrypted private-key export in jose

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.10.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65629

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.10.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9"
  ]
}

medium5.9

EEF-CVE-2026-65628Fix available

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.5.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65628

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.5.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.7.2",
    "1.7.3",
    "1.7.4",
    "1.7.5",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}

medium6.9

EEF-CVE-2026-65627Fix available

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.0.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65627

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.0.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.1.1",
    "1.1.2",
    "1.1.3",
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.2.0",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.7.2",
    "1.7.3",
    "1.7.4",
    "1.7.5",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}

medium5.9

EEF-CVE-2026-65626Fix available

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.3.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65626

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.3.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.7.2",
    "1.7.3",
    "1.7.4",
    "1.7.5",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}

medium5.9

EEF-CVE-2026-65625Fix available

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

Hex / jose

26 Oct 2026

jose Hex

Affected range	Recorded fix
From 1.2.0 before 1.11.13Semantic versions	1.11.13

Version evidence: OSV · EEF-CVE-2026-65625

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.2.0"
        },
        {
          "fixed": "1.11.13"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.11.0",
    "1.11.1",
    "1.11.10",
    "1.11.11",
    "1.11.12",
    "1.11.2",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.11.8",
    "1.11.9",
    "1.2.0",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.7.2",
    "1.7.3",
    "1.7.4",
    "1.7.5",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.9.0"
  ]
}