JWT Algorithm Confusion Security vulnerability with fast-jwt < 3.3.2 about fastify-jwt-jwks HOT 6 CLOSED

@simoneb Any ETA on when this can be published?

from fastify-jwt-jwks.

@simoneb I noticed you fixed fast-jwt, any chance you are already updating this repository as well?

from fastify-jwt-jwks.

Good point, I'm not quite sure why dependabot hasn't bumped fast-jwt in fastify/jwt.

from fastify-jwt-jwks.

Happy to put in a quick PR, just didn't want stomp on your toes.

As a side note: I think fastify-auth0-verify is in an odd state, given that it's own fast-jwt has been upgraded, but it's dependency on this library, pulls in the older fast-jwt.

from fastify-jwt-jwks.

Please do, I was largely relying on dependabot doing its job, but for whatever reason this is not happening. The dependencies are using loose semver specifiers, which would normally not receive bump PRs, but in case of advisories I was definitely expecting dependabot to kick in. Feel free to send PRs, I would appreciate it.

As for fastify-auth0-verify, I believe the dependency on @fastify/jwt is redundant

from fastify-jwt-jwks.

@simoneb Upgraded both, tests past. Best I can tell the fastify/jwt major version upgrade doesn't impact this lib, as the key prop isn't exposed.

from fastify-jwt-jwks.