What’s Vulnerable › Products

nearform fast-jwt vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your nearform fast-jwt version is affected

Latest nearform fast-jwt vulnerabilities

• CVE-2026-107724 — fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery (CVSS 7.4)
• CVE-2026-107723 — fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array (CVSS 8.1)
• CVE-2026-107722 — fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion (CVSS 9.8)
• CVE-2026-107721 — fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) (CVSS 5.9)
• CVE-2026-107720 — fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set (CVSS 7.4)
• CVE-2026-107719 — fast-jwt: Verifier cache accepts expired JWTs without iat. (CVSS 4.2)
• CVE-2026-44351 — fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass (CVSS 9.1)
• CVE-2026-35041 — ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification (CVSS 6.5)
• CVE-2026-35040 — fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) (CVSS 5.3)
• CVE-2026-35042 — fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) (CVSS 7.5)
• CVE-2026-35039 — fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) (CVSS 9.1)
• CVE-2026-34950 — fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key (CVSS 9.1)
• CVE-2025-30144 — Fast-JWT Improperly Validates iss Claims (CVSS 6.5)
• CVE-2023-48223 — fast-jwt JWT Algorithm Confusion (CVSS 5.9)