Peppermint npm Package Under Investigation for Hardcoded JWT Secret
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- peppermint (npm)
- Affected versions
- >= 0.5.5, <= 0.5.5 or >= 0.5.4.2, <= 0.5.4.2 or >= 0.5.3.2, <= 0.5.3.2 or >= 0.5.3.1, <= 0.5.3.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.1, <= 0.5.1 or >= 0.4.8, <= 0.4.8 or >= 0.4.7, <= 0.4.7 or >= 0.4.6, <= 0.4.6 or >= 0.4.2, <= 0.4.2 or >= 0.4, <= 0.4 or >= 0.3.5, <= 0.3.5 or >= 0.3.4, <= 0.3.4 or >= 0.3.3, <= 0.3.3 or >= 0.3.2, <= 0.3.2 or >= 0.3, <= 0.3 or >= 0.2.3, <= 0.2.3 or >= 0.2.2, <= 0.2.2 or >= 0.2.1, <= 0.2.1 or >= 0.2, <= 0.2 or >= 0.1.9, <= 0.1.9 or >= 0.1.8.5, <= 0.1.8.5 or >= 0.1.7.8, <= 0.1.7.8 or >= 0.1.7.7, <= 0.1.7.7 or >= 0.1.7.5, <= 0.1.7.5 or >= 0.1.6, <= 0.1.6 or >= 0.1.5, <= 0.1.5 or >= 0.1, <= 0.1
- Patched version
- Not yet available
An early warning has been issued for the peppermint npm package. Versions 0.1 to 0.5.5 reportedly contain a hardcoded JWT signing secret that could allow attackers to forge session tokens.
What happened
The peppermint npm package versions 0.1 to 0.5.5 are under investigation for containing a hardcoded JWT signing secret in the docker-compose.yml file. This secret, if exploited, allows unauthenticated attackers to generate valid session tokens for any user account. Attackers could use these tokens to access protected endpoints without proper credentials.
The vulnerability, tracked as CVE-2026-85391, has a CVSS score of 9.8, indicating a critical severity level. The issue was first flagged on September 3, 2026. There are no reports of this vulnerability being exploited in the wild at this time.
Users of the peppermint package should assess their exposure by checking if they are using any version within the affected range (0.1 to 0.5.5). If so, it is recommended to upgrade to a version that addresses this issue and rotate any session tokens that may have been compromised.
What to do about it
- Upgrade to a version of peppermint that fixes the hardcoded JWT signing secret.
- Rotate any session tokens that may have been generated using the affected versions of peppermint.
- Monitor the primary sources for updates on a patched version.
- Consult the NVD page for CVE-2026-85391 for the latest information on the vulnerability.
How 0Day would have caught this
peppermint is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using peppermint npm package versions 0.1 to 0.5.5.
What should I do right now?
Upgrade to a fixed version of peppermint and rotate any session tokens that may have been compromised.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.
Where can I find more information?
Consult the NVD page for CVE-2026-85391 for the latest information.