A critical remote code execution (RCE) vulnerability has been patched in the popular JsonWebToken open-source encryption library maintained by Okta Autho. The library is downloaded from Node Package Manager (NPM), a free library and registry for the publishing of JavaScript software packages utilized by developers. Specifically, JsonWebToken is utilized to digitally create, sign, and verify a JSON Web Token (JWT), the open-source standard defining how to securely transmit information between parties as a JSON object. The vulnerability, tracked as CVE-2022-23529, is described as an input validation flaw. A threat actor could exploit this vulnerability by manipulating the “secretOrPublicKey” argument in JsonWebToken’s verify() method, used to verify and return the unencrypted information. This can be carried out via maliciously crafted code input, allowing the attacker to gain control over a key retrieval parameter to take over accounts, impersonate users, steal sensitive information, and elevate privileges to carry out malicious follow-on activity. Although it is rated as high severity, the flaw received a CVSS score of 7.6/10 due to the fact that the attacker would still need to compromise the key management process between an application and a JsonWebToken server before being able to exploit this vulnerability. With an estimated 36 million NPM downloads per month, the popularity of the JsonWebToken poses a massive risk to supply chains. The patch implements additional checks for the “secretOrPublicKey” parameter, and CTIX analysts urge all JavaScript developers dependent on the library to upgrade to the secure version immediately.