nearform fast-jwt

• CVE-2026-107724 High 7.4 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery 0.3%
• CVE-2026-107723 High 8.1 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array 0.5%
• CVE-2026-107722 Critical 9.8 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion 0.4%
• CVE-2026-107721 Medium 5.9 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) 0.3%
• CVE-2026-107720 High 7.4 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set 0.3%
• CVE-2026-107719 Medium 4.2 fast-jwt: Verifier cache accepts expired JWTs without iat. 0.3%
• CVE-2026-44351 Critical 9.1 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass 0.2%
• CVE-2026-35041 Medium 4.2 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification 0.3%
• CVE-2026-35040 Medium 5.3 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) 0.4%
• CVE-2026-35042 High 7.5 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) 0.2%
• CVE-2026-35039 Critical 9.1 fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) 0.2%
• CVE-2026-34950 Critical 9.1 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key 0.2%
• CVE-2025-30144 Medium 6.5 Fast-JWT Improperly Validates iss Claims 0.6%
• CVE-2023-48223 Medium 5.9 fast-jwt JWT Algorithm Confusion 0.7%