All the vulnerabilities related to the version 0.2.6 of the package
Forgeable Public/Private Tokens in jws
Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.
Update to version 3.0.0 or later.
Out-of-bounds Read in base64url
Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Update to version 3.0.0 or later.
