CVE-2025-59936: get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

September 26, 2025 (updated September 29, 2025)

A vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism.

References

github.com/advisories/GHSA-qc2q-qhf3-235m
github.com/nearform/get-jwks
github.com/nearform/get-jwks/commit/1706a177a80a1759fe68e3339dc5a219ce03ddb9
github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m
nvd.nist.gov/vuln/detail/CVE-2025-59936

Code Behaviors & Features

Detect and mitigate CVE-2025-59936 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →