TI-2026-27174 CVE-2026-34950 · GHSA-mvf2-f6gm-w987
fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Priority HIGH 80
fast-jwt provides fast JSON Web Token (JWT) implementation.
nearform
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
nearform records in CISA KEVNo nearform vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Fast-jwt · all components
TI-2026-27245 CVE-2026-35042 · GHSA-hm7r-c7qw-ghp6
fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27243 CVE-2026-35040 · GHSA-3j8v-cgw4-2g6q
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Priority MEDIUM 63
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27244 CVE-2026-35041 · GHSA-cjw9-ghj4-fwxf
ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Priority MEDIUM 62
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2026-27242 CVE-2026-35039 · GHSA-rp9m-7r4c-75qg
Insufficient verification of data authenticity in nearform fast-jwt
Priority MEDIUM 47
fast-jwt provides fast JSON Web Token (JWT) implementation.
TI-2023-26087 CVE-2023-48223 · GHSA-c2ff-88x2-x9pg
fast-jwt JWT Algorithm Confusion
Priority LOW 28
fast-jwt provides fast JSON Web Token (JWT) implementation.