chore: Update jws@3 to 3.2.3 [SECURITY]

[everettbu]

Mirror of n8n-io/n8n#24834
Original author: app/renovate

---

This PR contains the following updates:

Package	Change	Age	Confidence
jws@3	3.2.2 → 3.2.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

auth0/node-jws Improperly Verifies HMAC Signature

CVE-2025-65945 / GHSA-869p-cjfg-cm3x

More information

Details

Overview

An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions.

Am I Affected?

You are affected by this vulnerability if you meet all of the following preconditions:

1. Application uses the auth0/node-jws implementation of JSON Web Signatures, versions <=3.2.2 || 4.0.0
2. Application uses the jws.createVerify() function for HMAC algorithms
3. Application uses user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines

You are NOT affected by this vulnerability if you meet any of the following preconditions:

1. Application uses the jws.verify() interface (note: auth0/node-jsonwebtoken users fall into this category and are therefore NOT affected by this vulnerability)
2. Application uses only asymmetric algorithms (e.g. RS256)
3. Application doesn’t use user-provided data from the JSON Web Signature Protected Header or Payload in the HMAC secret lookup routines

Fix

Upgrade auth0/node-jws version to version 3.2.3 or 4.0.1

Acknowledgement

Okta would like to thank Félix Charette for discovering this vulnerability.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
• https://nvd.nist.gov/vuln/detail/CVE-2025-65945
• https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
• https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
• https://github.com/auth0/node-jws
• https://github.com/auth0/node-jws/releases/tag/v3.2.3
• https://github.com/auth0/node-jws/releases/tag/v4.0.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

brianloveswords/node-jws (jws`@3`)

v3.2.3

Compare Source

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require
  that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key)
  when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.