Skip to contentNearform Fast-jwt vulnerabilities
- nearform fast-jwtfast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryCVE-2026-107724Fix available7.4 High
- nearform fast-jwtfast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayCVE-2026-107723Fix available8.1 High
- nearform fast-jwtfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionCVE-2026-107722Fix available9.8 Critical
- nearform fast-jwtfast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)CVE-2026-107721Fix available5.9 Medium
- nearform fast-jwtfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setCVE-2026-107720Public exploitFix available7.4 High
- nearform fast-jwtfast-jwt: Verifier cache accepts expired JWTs without iat.CVE-2026-107719Fix available4.2 Medium
- nearform fast-jwtfast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassCVE-2026-44351Public exploitFix available9.1 Critical
- nearform fast-jwtReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verificationCVE-2026-35041Fix available4.2 Medium
- nearform fast-jwtfast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)CVE-2026-35040Fix available5.3 Medium
- nearform fast-jwtfast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)CVE-2026-350427.5 High
- nearform fast-jwtfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)CVE-2026-35039Fix available9.1 Critical
- nearform fast-jwtfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyCVE-2026-34950Fix available9.1 Critical
- nearform fast-jwtFast-JWT Improperly Validates iss ClaimsCVE-2025-30144Public exploitFix available6.5 Medium
- nearform fast-jwtfast-jwt JWT Algorithm ConfusionCVE-2023-48223Public exploitFix available5.9 Medium