auth0/node-jsonwebtoken

Scanned on Jul 16, 2026

100

Risk score/ 100

Critical risk

Summary

Análise Heurística (IA indisponível) — 60 ocorrências detectadas: LOW-LEVEL CALL: Return value of .call() not captured — silent failure, ETH lost, JWT quantum-vulnerable algorithm, RSA key ≤ 2048 bits, RSA, ECDSA….

Critical

High

Medium

Low

Top findings

CriticalCWE-326RSA key ≤ 2048 bits

test/jwt.hs.tests.js:12

Raw evidence

const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });

CriticalCWE-326RSA key ≤ 2048 bits
test/rsa-public-key.tests.js:29
Raw evidence
```
const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
```
CriticalCWE-326RSA key ≤ 2048 bits
test/rsa-public-key.tests.js:19
Raw evidence
```
const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
```

CriticalCWE-326RSA key ≤ 2048 bits

test/async_sign.tests.js:64

Raw evidence

const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });

CriticalCWE-326RSA key ≤ 2048 bits
test/jwt.malicious.tests.js:19
Raw evidence
```
} = crypto.generateKeyPairSync('rsa', {modulusLength: 2048});
```

+ 55 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan