{"id":"EM-20261102-5WDC","url":"https://cyber.eventmonitor.net/incident/EM-20261102-5WDC/","type":"cve","title":"SD JWT JS Vulnerability (CVE-2026-62374)","subtitle":"CVE-2026-62374","subject":"CVE-2026-62374","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-02T17:54:39.000Z","firstSignal":"2026-10-29T17:18:10.143Z","lastSignal":"2026-11-02T17:54:39.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-02T17:54:39.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-02T17:54:39.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T17:18:10.143Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-02T17:54:39.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261102-5WDC created."}],"stages":[{"name":"Disclosed","at":"2026-10-29T17:18:10.143Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-29T17:18:10.143Z","detail":"CVSS 7.1 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T17:18:10.143Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-62374 (CVSS 7.1)","text":"SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62374"},{"at":"2026-11-02T17:54:39.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-f9j6-8p6x-r9j6 / CVE-2026-62374: SD JWT JS: Tampered disclosures silently dropped instead of rejected","text":"npm:@sd-jwt/decode, npm:@sd-jwt/core","url":"https://github.com/advisories/GHSA-f9j6-8p6x-r9j6"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-29T17:18:10.143","score":7.1,"severity":"HIGH","desc":"SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00226,"pct":0.13383,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}