TI-2026-69702 CVE-2026-107722 · GHSA-ww5h-9m49-7xx4
Incomplete fix in fast-jwt enables RSA to HS256 algorithm confusion
Priority HIGH 82
fast-jwt provides fast JSON Web Token (JWT) implementation.
nearform
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
nearform records in CISA KEVNo nearform vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
16 records
TI-2026-27174 CVE-2026-34950 · GHSA-mvf2-f6gm-w987
fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Priority HIGH 80
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2025-37324 CVE-2025-59936 · GHSA-qc2q-qhf3-235m
get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
Priority HIGH 80
get-jwks contains fetch utils for JWKS keys.
TI-2026-27245 CVE-2026-35042 · GHSA-hm7r-c7qw-ghp6
fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-69684 CVE-2026-107723 · GHSA-5hjw-83fp-phq9
Claim validator bypass in fast-jwt when JWT payload is a JSON array
Priority HIGH 70
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-69695 CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx
fast-jwt accepts public JWK JSON as HMAC key, enabling token forgery
Priority HIGH 68
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-69689 CVE-2026-107720 · GHSA-8wpc-h4q6-8fxv
fast-jwt accepts unsigned JWTs when the key is empty or null
Priority HIGH 68
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27243 CVE-2026-35040 · GHSA-3j8v-cgw4-2g6q
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Priority MEDIUM 63
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27244 CVE-2026-35041 · GHSA-cjw9-ghj4-fwxf
ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Priority MEDIUM 62
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2025-21484 CVE-2025-30144 · GHSA-gm45-q3v2-6cf8
Fast-JWT Improperly Validates iss Claims
Priority MEDIUM 62
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-69703 CVE-2026-107719 · GHSA-x937-hj6v-793p
Expired JWTs accepted from cache in fast-jwt verifier
Priority MEDIUM 53
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-32316 CVE-2026-44351 · GHSA-gmvf-9v4p-v8jc
fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass
Priority MEDIUM 47
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27242 CVE-2026-35039 · GHSA-rp9m-7r4c-75qg
Insufficient verification of data authenticity in nearform fast-jwt
Priority MEDIUM 47
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2024-16177 CVE-2024-24556 · GHSA-qhjf-hm5j-335w
XSS in @urql/next
Priority LOW 38
urql is a GraphQL client that exposes a set of helpers for several frameworks.
TI-2026-69685 CVE-2026-107721 · GHSA-687g-22h4-j4w4
fast-jwt clockTolerance Infinity bypasses exp and nbf checks
Priority LOW 28
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2023-26087 CVE-2023-48223 · GHSA-c2ff-88x2-x9pg
fast-jwt JWT Algorithm Confusion
Priority LOW 28
fast-jwt provides fast JSON Web Token (JWT) implementation.