Nearform vulnerabilities

Products

• Fast-jwt 14

Newest

• nearform fast-jwt fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery CVE-2026-107724 Fix available 7.4 HighOctober 8, 2026
• nearform fast-jwt fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array CVE-2026-107723 Fix available 8.1 HighOctober 8, 2026
• nearform fast-jwt fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion CVE-2026-107722 Fix available 9.8 CriticalOctober 8, 2026
• nearform fast-jwt fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) CVE-2026-107721 Fix available 5.9 MediumOctober 8, 2026
• nearform fast-jwt fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set CVE-2026-107720 Fix available 7.4 HighOctober 8, 2026
• nearform fast-jwt fast-jwt: Verifier cache accepts expired JWTs without iat. CVE-2026-107719 Fix available 4.2 MediumOctober 8, 2026
• nearform fast-jwt fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass CVE-2026-44351 Public exploitFix available 9.1 CriticalMay 6, 2026
• nearform fast-jwt ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification CVE-2026-35041 Fix available 4.2 MediumApril 9, 2026
• nearform fast-jwt fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) CVE-2026-35040 Fix available 5.3 MediumApril 9, 2026
• nearform fast-jwt fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVE-2026-35042 7.5 HighApril 3, 2026
• nearform fast-jwt fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) CVE-2026-35039 Fix available 9.1 CriticalApril 3, 2026
• nearform fast-jwt fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key CVE-2026-34950 Fix available 9.1 CriticalApril 2, 2026
• nearform get-jwks get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass CVE-2025-59936 Fix available 9.4 CriticalSeptember 26, 2025
• nearform fast-jwt Fast-JWT Improperly Validates iss Claims CVE-2025-30144 Public exploitFix available 6.5 MediumMarch 19, 2025
• nearform urql XSS in @urql/next CVE-2024-24556 Fix available 7.2 HighJanuary 30, 2024
• nearform fast-jwt fast-jwt JWT Algorithm Confusion CVE-2023-48223 Public exploitFix available 5.9 MediumNovember 20, 2023