CVE-2026-65629

Name of the Vulnerable Software and Affected Versions jose versions 1.10.0 through 1.11.12

Description The library uses a password hash with insufficient computational effort when exporting password-encrypted private keys. Specifically, the jose jwk:to der/2 (JOSE.JWK.to der/2) function utilizes the jose jwk der:to binary/3 function to serialize keys as PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme. This process employs hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with 2048 iterations and an 8-byte random salt, both of which are significantly lower than industry standards. This weakness allows an attacker who obtains an exported encrypted blob to perform an offline dictionary or brute-force attack to recover the private key.

Recommendations Update to version 1.11.13 or later. As a temporary workaround, use a long, high-entropy passphrase when exporting private keys with jose jwk:to der/2 (JOSE.JWK.to der/2). Restrict access to exported EncryptedPrivateKeyInfo blobs and ensure they are not stored in backups, repositories, object storage, or logs.