PRIMARY-SOURCE REVIEW · 2026-11-03T16:20:00+09:00

SD-JWT: silently discarded disclosures can change authorization

CVE-2026-62374 silently discards mismatched Disclosures and returns success. A valid signature can accompany fewer claims, affecting verifiers that allow access when a constraining claim is absent. Required key binding rejects on-path tampering; tampering by the holder remains a distinct condition.

What to check

@sd-jwt/core through 0.19.0 is affected, with 0.20.0 listed as the first fix. @sd-jwt/decode through 0.19.0 is affected but has no first fix listed. Reject missing required claims and verify each deployed dependency separately.

A first fixed version is listed only when the advisory provides one. Advisory counts are not incident counts.

Affected and fixed versions by advisory (1)

GHSA-f9j6-8p6x-r9j6

SD JWT JS: Tampered disclosures silently dropped instead of rejected

  • @sd-jwt/decode (npm): affected <= 0.19.0 → fixed No fixed version listed
  • @sd-jwt/core (npm): affected <= 0.19.0 → fixed 0.20.0

Primary sources

GHSA-f9j6-8p6x-r9j6

Related topics

DBHub: MySQL/MariaDB read-only bypass fixed in 0.22.6 · npm: 92 malicious-package advisories; check affected releases · PyPI: 2 malicious-package advisories; check affected releases · RubyGems: 3 malicious-package advisories; check affected releases