Skip to content
OpenAdvisories

Package · npm

fast-jwt

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.4
    CVE-2026-107720 Public exploit

    fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedA…

    nearform fast-jwt fast-jwt npm
  • Critical 9.1
    CVE-2026-44351 Public exploit

    fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When t…

    nearform fast-jwt fast-jwt npm
  • Medium 6.5
    CVE-2025-30144 Public exploit

    Fast-JWT Improperly Validates iss Claims

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a val…

    nearform fast-jwt fast-jwt npm
  • Medium 5.9
    CVE-2023-48223 Public exploit

    fast-jwt JWT Algorithm Confusion

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …

    nearform fast-jwt fast-jwt npm