JWT 'none' algorithm accepted under fallback path

/summary

Summary

When the configured algorithm list is empty (a common misuse), the shim falls back to 'none', allowing forged tokens.

/affected-artifacts

Affected artifacts (1)

▲ NPMv2.0.7

express-jwt-shim

HIGH

Drop-in JWT verification middleware for Express.

AI confidence74/100

Downloads: 412.0K/wk
Zero-days: 1
Publisher: midware-co
Last scan: 2d ago

/poc

Proof-of-concept

# Reproduction steps redacted under coordinated disclosure.
# Full PoC will be published with the advisory at embargo expiry.

$ zds reproduce ZDS-2025-0133