AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2017-16007

MEDIUM · CVSS 5.9 EPSS 0.93% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-06-04 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

Exhibit — Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
gist.github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2017-16007
Severity
MEDIUM
CVSS
5.9
EPSS
0.93%
Java

Original Filing — NVD Description

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.