Security
فارسی
All products

fast-jwt

npm · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
fast-jwt: Verifier cache accepts expired JWTs without iat.CVE-2026-107719 · GHSA-X937-HJ6V-793P fast-jwt npm Medium Fix reported
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setCVE-2026-107720 · GHSA-8WPC-H4Q6-8FXV fast-jwt npm High Fix reported
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionCVE-2026-107722 · GHSA-WW5H-9M49-7XX4 fast-jwt npm Critical Fix reported
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)CVE-2026-107721 · GHSA-687G-22H4-J4W4 fast-jwt npm Medium Fix reported
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayCVE-2026-107723 · GHSA-5HJW-83FP-PHQ9 fast-jwt npm High Fix reported
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryCVE-2026-107724 · GHSA-G3JJ-5CMM-3HXX fast-jwt npm High Fix reported
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolverCVE-2026-44351 · GHSA-GMVF-9V4P-V8JC fast-jwt npm Critical Fix reported
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verificationCVE-2026-35041 · GHSA-CJW9-GHJ4-FWXF fast-jwt npm Medium Fix reported
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)CVE-2026-35040 · GHSA-3J8V-CGW4-2G6Q fast-jwt npm Medium Fix reported
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)CVE-2026-35039 · GHSA-RP9M-7R4C-75QG fast-jwt npm Critical Fix reported
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyCVE-2026-34950 · GHSA-MVF2-F6GM-W987 fast-jwt npm Critical Fix reported
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)CVE-2026-35042 · GHSA-HM7R-C7QW-GHP6 fast-jwt npm High No fix reported
Fast-JWT Improperly Validates iss ClaimsCVE-2025-30144 · GHSA-GM45-Q3V2-6CF8 fast-jwt npm Medium Fix reported
JWT Algorithm ConfusionCVE-2023-48223 · GHSA-C2FF-88X2-X9PG fast-jwt npm Medium Fix reported