Header Picks The Key

This middleware guards a resource server. The authorization server signs with RS256 and publishes the matching public key at a JWKS endpoint that anyone can fetch. The service has been on the same pinned dependency since 2021.

// package.json: "jsonwebtoken": "8.5.1"
import jwt from 'jsonwebtoken'
import fs from 'node:fs'

const RSA_PUBLIC = fs.readFileSync('/etc/keys/auth-public.pem')

export function verify(token) {
  const header = JSON.parse(
    Buffer.from(token.split('.')[0], 'base64url').toString()
  )
  return jwt.verify(token, RSA_PUBLIC, { algorithms: [header.alg] })
}

What can someone who holds only the published public key do here?

Nothing durable. Pinning algorithms matters only when the key is symmetric, because any change to the payload changes the signature.

Forge any payload, sign it with HMAC-SHA256 using the PEM bytes of the public key as the secret, and set alg to HS256; the middleware then hands that same public key to an HMAC verify and the tag matches.

Nothing. A public key can verify an RS256 signature but cannot produce one, so reading alg from the token is untidy rather than exploitable.

Point kid at a different file so the library loads a key the attacker controls, which is the actual injection this code allows.