CVE-2026-102265: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyJWTto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
Which deployments are exposed to request failures?
Applications using PyJWT versions from 2.13.0 up to, but not including, 2.14.0 are affected when they decode attacker-controlled JWTs. An unauthenticated client can submit a malformed token with a deeply nested header and trigger an HTTP 500 request-level failure.
Does exploitation require credentials or user interaction?
No. The issue has network attack vector, low attack complexity, no privileges required, and no user interaction; the attacker only needs a path that passes a supplied token to jwt.decode().
What is the remediation?
Upgrade PyJWT to version 2.14.0, which fixes the uncaught RecursionError. The supplied information does not identify an alternative mitigation for deployments that cannot yet upgrade.
How can I identify attempted exploitation?
Look for request failures or HTTP 500 responses associated with JWT decoding where a RecursionError escapes from json.loads or PyJWS._load in jwt/api_jws.py. The triggering input is a token containing a deeply nested header.