fast-jwt
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 14 advisory(ies) without a verdict
Advisories (14)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3j8v-cgw4-2g6q fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) | < 6.2.1 | Undetermined |
| GHSA-5hjw-83fp-phq9 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array | < 6.3.0 | Undetermined |
| GHSA-687g-22h4-j4w4 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) | < 6.3.0 | Undetermined |
| GHSA-8wpc-h4q6-8fxv fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set | < 6.3.1 | Undetermined |
| GHSA-c2ff-88x2-x9pg JWT Algorithm Confusion | < 3.3.2 | Undetermined |
| GHSA-cjw9-ghj4-fwxf fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification | 5.0.0 – < 6.2.1 | Undetermined |
| GHSA-g3jj-5cmm-3hxx fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery | 6.2.4 – < 6.3.0 | Undetermined |
| GHSA-gm45-q3v2-6cf8 Fast-JWT Improperly Validates iss Claims | < 5.0.6 | Undetermined |
| GHSA-gmvf-9v4p-v8jc fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver | < 6.2.4 | Undetermined |
| GHSA-hm7r-c7qw-ghp6 fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation) | ≤ 6.1.0 | Undetermined |
| GHSA-mvf2-f6gm-w987 fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key | < 6.2.0 | Undetermined |
| GHSA-rp9m-7r4c-75qg fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) | 0.0.1 – < 6.2.0 | Undetermined |
| GHSA-ww5h-9m49-7xx4 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion | 6.2.0 – < 6.3.0 | Undetermined |
| GHSA-x937-hj6v-793p fast-jwt: Verifier cache accepts expired JWTs without iat. | < 6.3.4 | Undetermined |
Sources
| Source | Licence |
|---|