Composer web-token/jwt-framework has 4 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| GHSA-3prj-6hqw-cm82 | PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | high | 0.0 | <3.4.10 or >=4.0.0 and <4.0.7 or >=4.1.0 and <4.1.7 | 3.4.10, 4.0.7, 4.1.7 |
| GHSA-5739-39v2-5754 | RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle | unknown | 0.0 | <3.4.10 or >=4.0.0 and <4.0.7 or >=4.1.0 and <4.1.7 | 3.4.10, 4.0.7, 4.1.7 |
| GHSA-6vvh-pxr4-25r7 | Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption | unknown | 0.0 | <3.4.10 or >=4.0.0 and <4.0.7 or >=4.1.0 and <4.1.7 | 3.4.10, 4.0.7, 4.1.7 |
| GHSA-jc38-x7x8-2xc8 | PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks | high | 0.0 | <3.4.10 or >=4.0.0 and <4.0.7 or >=4.1.0 and <4.1.7 | 3.4.10, 4.0.7, 4.1.7 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked