Detections
Analytics

SCA: security update for @sd-jwt/core, @sd-jwt/decode (GHSA-f9j6-8p6x-r9j6)

high Tenable Self-Hosted Container Security Plugin ID 478194

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In
 version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered
 Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set,
 reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid
 JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case,
 the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering
 syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901
 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section
 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission
 primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker
 can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key
 binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying
 party defaults to allowing access when a constraining age, role, or restriction claim is absent, the
 silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-
 jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.
 (CVE-2026-62374)

Solution

Update the @sd-jwt/core library and its related packages to version 0.20.0 or later.

See Also

https://github.com/advisories/GHSA-f9j6-8p6x-r9j6

Plugin Details

Severity: High

ID: 478194

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/2/2026

Updated: 11/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 95.65

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-62374

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/2/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-62374

cwe: CWE-176