CVE-2026-65630

Name of the Vulnerable Software and Affected Versions jose versions 1.10.0 through 1.11.12

Description A timing side channel in the pure-Erlang Curve25519 fallback allows the recovery of a long-term X25519 private key. The implementation uses a recursive Montgomery ladder in the jose jwa x25519:curve25519/2 function, where operations such as jose jwa x25519:montgomery add/3 and jose jwa x25519:montgomery double/1 rely on value-dependent Erlang bignum arithmetic. Consequently, the execution time of public entry points including jose jwa x25519:scalarmult/2, jose jwa x25519:x25519/2, jose jwa x25519:x25519 base/1, and jose jwa x25519:sk to pk/1 varies based on the private key. This is exploitable when a service decrypts attacker-supplied ECDH-ES (JWE) messages via JOSE.JWK.box decrypt ecdh es/2, which calls jose jwa curve25519:x25519 shared secret/2. An attacker measuring decryption timing can recover the private key bit by bit, compromising data confidentiality and authenticity.

Recommendations Update jose to version 1.11.13 or later. Use a constant-time native X25519 implementation by installing the libsodium or libdecaf NIF, or by using an OTP release where the crypto application provides x25519. Avoid forcing the pure-Erlang Curve25519 fallback by not calling JOSE.crypto fallback(true) or JOSE.curve25519 module(:jose jwa curve25519) for long-lived keys.