CVE-2024-34273 Overview
CVE-2024-34273 is a prototype pollution vulnerability in the njwt JavaScript library up to version v0.4.0. The flaw resides in the Parser.prototype.parse method, which processes JSON Web Tokens (JWTs) without sanitizing keys such as __proto__. An attacker who can supply a crafted JWT can modify the properties of Object.prototype, affecting every object in the running Node.js process. The weakness is classified as [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).
Critical Impact
Successful exploitation lets a remote attacker corrupt shared object prototypes, leading to denial of service or altered application logic in downstream code paths.
Affected Products
- njwt library up to and including version v0.4.0
- Node.js applications that invoke Parser.prototype.parse on attacker-controlled JWTs
- Downstream packages that depend on vulnerable njwt releases
Discovery Timeline
- 2024-05-16 - CVE-2024-34273 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-34273
Vulnerability Analysis
The njwt library parses JWTs by decoding the header and payload segments from Base64URL and reconstructing JavaScript objects from the resulting JSON. In vulnerable releases, Parser.prototype.parse merges parsed key-value pairs into internal objects without filtering reserved property names. When the JSON contains a __proto__ key, the assignment reaches Object.prototype and pollutes every object in the runtime.
Because tokens are typically supplied over the network, attackers do not need authentication or user interaction to reach the vulnerable code path. Exploitation complexity is elevated because the attacker must craft a payload that both survives JWT parsing and produces useful pollution in the target application. The primary observed impact is availability loss: polluted prototypes can trigger unexpected exceptions, infinite loops, or crashes in unrelated code.
Root Cause
The root cause is unsafe property assignment during JSON deserialization inside Parser.prototype.parse. The parser copies attacker-controlled keys directly onto host objects without using Object.create(null), hasOwnProperty checks, or a deny list for __proto__, constructor, and prototype. This matches the pattern described by [CWE-1321].
Attack Vector
An attacker delivers a malicious JWT to any endpoint that invokes the vulnerable parser. The payload contains a JSON object with a __proto__ member whose value defines properties inherited by all objects. Once parsed, the polluted attributes persist for the lifetime of the process. The vulnerability manifests entirely in the JSON handling of Parser.prototype.parse; see the GitHub Security Advisory CVE-2024-34273 for a reproducer and payload structure.
Detection Methods for CVE-2024-34273
Indicators of Compromise
- JWT payloads or headers containing the literal string __proto__, constructor, or prototype as JSON keys
- Unexpected Node.js process crashes or exceptions referencing inherited properties after JWT processing
- Application log entries showing malformed JWTs decoded through njwt shortly before instability
Detection Strategies
- Perform Software Composition Analysis (SCA) to identify projects declaring njwt at version v0.4.0 or earlier in package.json or lockfiles
- Inspect inbound HTTP requests containing Authorization: Bearer headers for Base64URL-decoded payloads that include prototype-related keys
- Add runtime instrumentation that logs any assignment reaching Object.prototype during request handling
Monitoring Recommendations
- Forward Node.js application logs and JWT validation errors to a centralized analytics platform for correlation across services
- Alert on repeated JWT parse failures from a single source, which often accompany pollution probing
- Track process restarts and unhandled promise rejections in services that consume JWTs to catch post-exploitation instability
How to Mitigate CVE-2024-34273
Immediate Actions Required
- Inventory all applications and container images that bundle njwt and prioritize those exposed to untrusted JWT input
- Upgrade njwt to a fixed release beyond v0.4.0 once published by the maintainers, or migrate to a maintained JWT library
- Add input validation that rejects JWTs whose decoded JSON contains __proto__, constructor, or prototype keys before invoking Parser.prototype.parse
Patch Information
No vendor patch URL is listed in the NVD entry at the time of publication. Consult the GitHub Security Advisory CVE-2024-34273 for the latest remediation status and monitor the upstream njwt repository for a fixed release.
Workarounds
- Freeze Object.prototype at application startup with Object.freeze(Object.prototype) to block runtime pollution
- Wrap Parser.prototype.parse with a sanitizer that strips reserved keys from decoded JWT segments before parsing continues
- Enforce strict JWT schema validation and reject tokens whose claims do not match an allow list of expected properties
# Configuration example
npm ls njwt
npm audit --production
# Pin to a fixed release once available
npm install njwt@latest --save-exact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.