nearform get-jwks up to 11.0.1 iss escape output

Summaryinfo

A vulnerability was found in nearform get-jwks up to 11.0.1. It has been rated as critical. This issue affects some unknown processing of the component iss Handler. The manipulation leads to escape output. This vulnerability is referenced as CVE-2025-59936. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in nearform get-jwks up to 11.0.1 and classified as critical. This issue affects an unknown function of the component iss Handler. The manipulation with an unknown input leads to a escape output vulnerability. Using CWE to declare the problem leads to CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-59936 since 09/23/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 11.0.2 eliminates this vulnerability. Applying the patch 1706a177a80a1759fe68e3339dc5a219ce03ddb9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202509-4279) and EUVD (EUVD-2025-31349). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• nearform

Name

• get-jwks

Version

• 11.0.0
• 11.0.1

License

• open-source

Website

• Product: https://github.com/nearform/get-jwks/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion