Product by Nearform
Fast-jwt
14 known vulnerabilities in Fast-jwt (Nearform), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-107722 | Nearform Fast-jwt: Improper Verification of Cryptographic Signature | 9.8 | |
| High | CVE-2026-107723 | fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array | 8.1 | |
| High | CVE-2026-107720 | Nearform Fast-jwt: Improper Verification of Cryptographic Signature | 7.4 | |
| High | CVE-2026-107724 | fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery | 7.4 | |
| Medium | CVE-2026-107721 | Nearform Fast-jwt: Insufficient Session Expiration | 5.9 | |
| Critical | CVE-2026-44351 | fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass | 9.1 | |
| Critical | CVE-2026-34950 | Nearform Fast-jwt: Use of a Broken or Risky Cryptographic Algorithm | 9.1 | |
| Critical | CVE-2026-35039 | Nearform Fast-jwt: Improper Validation of Unsafe Equivalence in Input | 9.1 | |
| Medium | CVE-2025-30144 | Fast-JWT Improperly Validates iss Claims | 6.5 | |
| Medium | CVE-2023-48223 | fast-jwt JWT Algorithm Confusion | 5.9 | |
| Medium | CVE-2026-107719 | Nearform Fast-jwt: Insufficient Session Expiration | 4.2 | |
| High | CVE-2026-35042 | fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | 7.5 | |
| Medium | CVE-2026-35041 | ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification | 6.5 | |
| Medium | CVE-2026-35040 | fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) | 5.3 |