Skip to content
OpenAdvisories

Package · npm

fast-jwt

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-107721

    fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive a…

    nearform fast-jwt fast-jwt npm
  • Medium 4.2
    CVE-2026-107719

    fast-jwt: Verifier cache accepts expired JWTs without iat.

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js…

    nearform fast-jwt fast-jwt npm
  • Medium 4.2
    CVE-2026-35041

    ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

    fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled an…

    nearform fast-jwt fast-jwt npm
  • Medium 5.3
    CVE-2026-35040

    fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. T…

    nearform fast-jwt fast-jwt npm
  • Medium 6.5
    CVE-2025-30144 Public exploit

    Fast-JWT Improperly Validates iss Claims

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a val…

    nearform fast-jwt fast-jwt npm
  • Medium 5.9
    CVE-2023-48223 Public exploit

    fast-jwt JWT Algorithm Confusion

    fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …

    nearform fast-jwt fast-jwt npm