Skip to content
OpenAdvisories

Package · npm

fast-jwt

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.4
    CVE-2026-107724

    fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

    fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS…

    nearform fast-jwt fast-jwt npm
  • High 8.1
    CVE-2026-107723

    fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim va…

    nearform fast-jwt fast-jwt npm
  • High 7.4
    CVE-2026-107720 Public exploit

    fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedA…

    nearform fast-jwt fast-jwt npm
  • High 7.5
    CVE-2026-35042

    fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not und…

    nearform fast-jwt fast-jwt npm