Vulnerabilities

TI-2026-69695 CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx

fast-jwt accepts public JWK JSON as HMAC key, enabling token forgery

HIGH 68

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00282 Published 2026-10-08 Fixed in 6.3.0 CWE-347

TI-2026-69684 CVE-2026-107723 · GHSA-5hjw-83fp-phq9

Claim validator bypass in fast-jwt when JWT payload is a JSON array

HIGH 70

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00455 Published 2026-10-08 Fixed in 6.3.0 CWE-1287

TI-2026-69702 CVE-2026-107722 · GHSA-ww5h-9m49-7xx4

Incomplete fix in fast-jwt enables RSA to HS256 algorithm confusion

HIGH 82

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00356 Published 2026-10-08 Fixed in 6.3.0 CWE-347

TI-2026-69685 CVE-2026-107721 · GHSA-687g-22h4-j4w4

fast-jwt clockTolerance Infinity bypasses exp and nbf checks

LOW 28

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.00341 Published 2026-10-08 Fixed in 6.3.0 CWE-613

TI-2026-69689 CVE-2026-107720 · GHSA-8wpc-h4q6-8fxv

fast-jwt accepts unsigned JWTs when the key is empty or null

HIGH 68

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00324 Published 2026-10-08 Fixed in 6.3.1 CWE-20

TI-2026-69703 CVE-2026-107719 · GHSA-x937-hj6v-793p

Expired JWTs accepted from cache in fast-jwt verifier

MEDIUM 53

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00272 Published 2026-10-08 Fixed in 6.3.4 CWE-613

TI-2026-32316 CVE-2026-44351 · GHSA-gmvf-9v4p-v8jc

fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

MEDIUM 47

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0025 Published 2026-05-13 Fixed in 6.2.4 CWE-1391

TI-2026-27244 CVE-2026-35041 · GHSA-cjw9-ghj4-fwxf

ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

MEDIUM 62

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00272 Published 2026-04-09 Fixed in 6.2.1 CWE-1333

TI-2026-27243 CVE-2026-35040 · GHSA-3j8v-cgw4-2g6q

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

MEDIUM 63

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00398 Published 2026-04-09 Fixed in 6.2.1 CWE-440

TI-2026-27245 CVE-2026-35042 · GHSA-hm7r-c7qw-ghp6

fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

HIGH 72

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00158 Published 2026-04-06 No fix listed CWE-345

TI-2026-27242 CVE-2026-35039 · GHSA-rp9m-7r4c-75qg

Insufficient verification of data authenticity in nearform fast-jwt

MEDIUM 47

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00216 Published 2026-04-06 Fixed in 6.2.0 CWE-1289

TI-2026-27174 CVE-2026-34950 · GHSA-mvf2-f6gm-w987

fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

HIGH 80

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0025 Published 2026-04-06 Fixed in 6.2.0 CWE-327

TI-2025-37324 CVE-2025-59936 · GHSA-qc2q-qhf3-235m

get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

HIGH 80

get-jwks contains fetch utils for JWKS keys.

CVSS 3.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00418 Published 2025-09-27 Fixed in 11.0.2 CWE-116

TI-2025-21484 CVE-2025-30144 · GHSA-gm45-q3v2-6cf8

Fast-JWT Improperly Validates iss Claims

MEDIUM 62

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00592 Published 2025-03-19 Fixed in 5.0.6 CWE-290

TI-2024-16177 CVE-2024-24556 · GHSA-qhjf-hm5j-335w

XSS in @urql/next

LOW 38

urql is a GraphQL client that exposes a set of helpers for several frameworks.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00355 Published 2024-01-30 Fixed in 1.1.1 CWE-79

TI-2023-26087 CVE-2023-48223 · GHSA-c2ff-88x2-x9pg

fast-jwt JWT Algorithm Confusion

LOW 28

fast-jwt provides fast JSON Web Token (JWT) implementation.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00681 Published 2023-11-20 Fixed in 3.3.2 CWE-20

Vulnerabilities

Filters