Skip to content
OpenAdvisories

Package · npm

fast-jwt

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-107720 Public exploit

    fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedA…

    nearform fast-jwt fast-jwt npm