Fix HIGH severity jws vulnerability (CVE-2023-35916) #2203
Conversation
Adds pnpm override to force jws to version 3.2.3, which fixes the improper HMAC signature verification vulnerability in the auth0/node-jws package. This vulnerability affected the jsonwebtoken package used for license validation in react-on-rails-pro-node-renderer.
WalkthroughA new pnpm dependency override for the "jws" package is added to package.json, pinning it to version 3.2.3. This is a single-line configuration change that specifies a specific version constraint for this transitive dependency. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code ReviewSummaryThis PR addresses CVE-2023-35916, a HIGH severity vulnerability in the ✅ Positive Aspects
|
size-limit report 📦
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{rb,js,ts,jsx,tsx,json,yml,yaml,md}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{rb,js,ts,jsx,tsx,json,yml,yaml,md}: ALWAYS runbundle exec rubocopand fix ALL violations before every commit/push
ALWAYS ensure files end with a newline character before committing
Files:
package.json
**/*.{js,ts,jsx,tsx,json,css,scss,md}
📄 CodeRabbit inference engine (CLAUDE.md)
ALWAYS let Prettier handle ALL formatting - never manually format code
Files:
package.json
**/*.{json,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
When resolving merge conflicts in configuration files, verify file paths are correct and test affected scripts before committing
Files:
package.json
🧠 Learnings (3)
📓 Common learnings
Learnt from: CR
Repo: shakacode/react_on_rails PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-10T09:27:45.093Z
Learning: Applies to /CHANGELOG.md : Update `/CHANGELOG.md` for open-source features, bug fixes, breaking changes, deprecations, and performance improvements using format: `[PR 1818](https://github.com/shakacode/react_on_rails/pull/1818) by [username](https://github.com/username)`
Learnt from: CR
Repo: shakacode/react_on_rails PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-10T09:27:45.093Z
Learning: Applies to **/*.{js,ts,jsx,tsx} : Only use `pnpm` as the JavaScript package manager, never use `npm` or `yarn`
Learnt from: alexeyr-ci
Repo: shakacode/react_on_rails PR: 1687
File: spec/dummy/package.json:0-0
Timestamp: 2025-01-23T18:20:45.824Z
Learning: When adding or updating dependencies in spec/dummy/package.json, maintain version consistency with other package.json files in the codebase to avoid potential version conflicts.
📚 Learning: 2025-01-23T18:20:45.824Z
Learnt from: alexeyr-ci
Repo: shakacode/react_on_rails PR: 1687
File: spec/dummy/package.json:0-0
Timestamp: 2025-01-23T18:20:45.824Z
Learning: When adding or updating dependencies in spec/dummy/package.json, maintain version consistency with other package.json files in the codebase to avoid potential version conflicts.
Applied to files:
package.json
📚 Learning: 2025-12-10T09:27:45.093Z
Learnt from: CR
Repo: shakacode/react_on_rails PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-10T09:27:45.093Z
Learning: Applies to **/*.{js,ts,jsx,tsx} : Only use `pnpm` as the JavaScript package manager, never use `npm` or `yarn`
Applied to files:
package.json
🔇 Additional comments (2)
package.json (2)
119-119: No action needed. Thejwsdependency at version 3.2.3 is isolated to the root package.json and doesn't require version consistency checks across other workspace files.spec/dummy/package.jsondoesn't exist in this repository, and no other package.json files reference jws.
119-119: Use CVE-2025-65945 instead of CVE-2023-35916 in the PR description.Version 3.2.3 does fix the HMAC signature verification vulnerability (CVE-2025-65945). This CVE affects jws versions ≤ 3.2.2 and 4.0.0, where HMAC (HS256) signature verification can be bypassed when using
jws.createVerify()with user-controlled header/payload in secret-lookup logic. The fix is confirmed in jws 3.2.3 (and 4.0.1). Update the PR description to reference the correct CVE identifier and link to the GitHub advisory (GHSA-869p-cjfg-cm3x) for clarity.
| "sentry-testkit>express": "npm:[email protected]", | ||
| "jws": "3.2.3" | ||
| } |
There was a problem hiding this comment.
Add documentation explaining the security fix.
The PR objectives indicate that documentation updates are incomplete. For a security vulnerability (CVE-2023-35916 - improper HMAC signature verification in node-jws), add documentation describing the vulnerability and how the jws 3.2.3 override mitigates it.
Where should the security fix documentation be added (e.g., a SECURITY.md file, the README, or a docs directory)?
🤖 Prompt for AI Agents
In package.json around lines 118 to 120, the PR updated jws to 3.2.3 as a
security override but lacks documentation; add a SECURITY.md at the repository
root (and a short pointer in README.md) that briefly describes CVE-2023-35916
(improper HMAC signature verification), lists affected versions, states that we
override/lock jws to 3.2.3 to mitigate the issue, shows the exact package.json
override snippet and upgrade/remediation steps for users, includes
references/links to the CVE and upstream patch, the PR/commit that applied the
change, and a date + contact for incident questions so consumers can verify the
fix and upgrade guidance.
Add a CHANGELOG entry for the security vulnerability fix.
The PR objectives indicate that the CHANGELOG entry is incomplete. A security vulnerability fix (CVE-2023-35916) must be documented in CHANGELOG.md. Based on learnings, use the format: [PR 2203](https://github.com/shakacode/react_on_rails/pull/2203) by [Seifeldin7](https://github.com/Seifeldin7) followed by a description of the fix.
Would you like me to generate the CHANGELOG entry following the documented format?
🤖 Prompt for AI Agents
In package.json around lines 118 to 120, the PR omitted a CHANGELOG entry
documenting the security vulnerability fix (CVE-2023-35916); add a new entry to
CHANGELOG.md using the prescribed format: include the PR link and author link
like `[PR 2203](https://github.com/shakacode/react_on_rails/pull/2203) by
[Seifeldin7](https://github.com/Seifeldin7)` followed by a concise sentence
describing the fix for CVE-2023-35916 (e.g., dependency update or patch
applied), place it under the appropriate unreleased or version heading, and save
the file.
| "sentry-testkit>body-parser": "npm:[email protected]", | ||
| "sentry-testkit>express": "npm:[email protected]" | ||
| "sentry-testkit>express": "npm:[email protected]", | ||
| "jws": "3.2.3" |
There was a problem hiding this comment.
@Seifeldin7 Keeping it as an override means that even if jsonwebtoken is updated in a later PR and wants a later jws version, it won't get updated automatically. Instead, my suggestion in such a case is to use overrides to update the lockfile and then restore the original package.json. The new lockfile should still satisfy it.
You could make the override something like >=3.2.3 but I think that has its own problems.
If overrides influenced our clients' resolution, it would be different, but I believe they don't.
Code Review - PR #2203Thank you for addressing this security vulnerability! This is an important fix. Here's my comprehensive review: ✅ Security Fix - ApprovedVulnerability: CVE-2023-35916 - Improper HMAC signature verification in jws package 📋 Code Quality Assessment✅ Strengths
|
Adds pnpm override to force jws to version 3.2.3, which fixes the improper HMAC signature verification vulnerability in the auth0/node-jws package. This vulnerability affected the jsonwebtoken package used for license validation in react-on-rails-pro-node-renderer.
Summary
Remove this paragraph and provide a general description of the code changes in your pull
request... were there any bugs you had fixed? If so, mention them. If
these bugs have open GitHub issues, be sure to tag them here as well,
to keep the conversation linked together.
Pull Request checklist
Remove this line after checking all the items here. If the item is not applicable to the PR, both check it out and wrap it by
~.Add the CHANGELOG entry at the top of the file.
Other Information
Remove this paragraph and mention any other important and relevant information such as benchmarks.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.