This repository was archived by the owner on Aug 24, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Aug 24, 2026. It is now read-only.
Snyk Reported issue with @okta/jwt-verifier@3.0.0 > njwt@2.0.0 #106
Description
the package @okta/jwt-verifier@3.0.0 is having njwt@2.0.0 as a dependency\
https://www.npmjs.com/package/@okta/jwt-verifier?activeTab=dependencies
snyk has reported an issue with njwt@2.0.0
https://security.snyk.io/vuln/SNYK-JS-NJWT-6861582.
please check the attached image to view the issue reported by snyk.
is there an update that can resolve the issue for okta/jwt-verifier
Reacted by eruecker55, bdelongamfam, Dan Sternfeld, Mike Waldner and Vesselin Jivkov
Activity
dansternfeld1 commentedon Jun 11, 2024
Looks like @jaredperreault-okta is addressing this in #107
Thank you, Jared!
nattap0l commentedon Jun 12, 2024
Hi i found error when start application
njwt@2.0.1 is new version update i found error this below from @okta/jwt-verifier@3.0.1
/var/www/engine/project/node_modules/@okta/jwt-verifier/lib.js:241
jwt[methodName] = method.bind({ body: jwtBodyProxy })
TypeError: Cannot assign to read only property 'setClaim' of object '[object Object]'
at /var/www/engine/project/node_modules/@okta/jwt-verifier/lib.js:241:29
Node.js v18.x.x
@dansternfeld1
dansternfeld1 commentedon Jun 12, 2024
cc @jaredperreault-okta -- see above
jaredperreault-okta commentedon Jun 12, 2024
@nattap0l This has been addressed in
@okta/jwt-verifierpackage directly in version3.2.1.3.2.2was also just released, which includes a fix for the CVE