Generated on Apr 29, 2024 via pnpm

Npm

Home

express-jwt 7.7.3

JWT authentication middleware.

auth

authn

authentication

Package summary

issues

licenses

Package created

23 Oct 2013

Version published

30 May 2022

Maintainers

Total deps

Direct deps

License

MIT

Issues

3 moderate severity issues

moderate

jsonwebtoken@8.5.1

jsonwebtoken unrestricted key type could lead to legacy keys usage

Recommendation: Upgrade to version 9.0.0 or later

via: jsonwebtoken@8.5.1

jsonwebtoken@8.5.1

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

Recommendation: Upgrade to version 9.0.0 or later

via: jsonwebtoken@8.5.1

jsonwebtoken@8.5.1

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Recommendation: Upgrade to version 9.0.0 or later

via: jsonwebtoken@8.5.1

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

28 Packages, Including:

@types/body-parser@1.19.5

@types/connect@3.4.38

@types/express-serve-static-core@4.19.0

@types/express-unless@0.5.3

@types/express@4.17.21

@types/http-errors@2.0.4

@types/jsonwebtoken@8.5.9

@types/mime@1.3.5

@types/node@20.12.7

@types/qs@6.9.15

@types/range-parser@1.2.7

@types/send@0.17.4

@types/serve-static@1.15.7

express-jwt@7.7.3

express-unless@1.0.0

jsonwebtoken@8.5.1

jwa@1.4.1

jws@3.2.2

lodash.includes@4.3.0

lodash.isboolean@3.0.3

lodash.isinteger@4.0.4

lodash.isnumber@3.0.3

lodash.isplainobject@4.0.6

lodash.isstring@4.0.1

lodash.once@4.1.1

ms@2.1.3

safe-buffer@5.2.1

undici-types@5.26.5

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

buffer-equal-constant-time@1.0.1

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

1 Packages, Including:

ecdsa-sig-formatter@1.0.11

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

semver@5.7.2

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of express-jwt 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
@types/express-unless	0.5.3	1.91 kB	MIT	prod
@types/jsonwebtoken	8.5.9	3.95 kB	MIT	prod
express-unless	1.0.0	3.38 kB	MIT	prod
jsonwebtoken	8.5.1	21.01 kB	MIT	prod	3

Tree

Treemap

Recent Versions

express-jwt 7.7.3