Skip to main content
cve.nowby Sazabi
← npm
npmPackage

fast-jwt

14 known vulnerabilities (4 critical, 4 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
6.3.6 (Oct 26, 2026): no advisory affects it
Newest unaffected release
6.3.6 (Oct 26, 2026), the latest release
Advisories
14 · 4 critical, 4 high, 6 medium
Weekly downloads
1.9M
Dependents
150
Releases
73 since 0.1.0 (Jun 23, 2020)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

    Affected: from 6.2.4, fixed in 6.3.0.

    Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure).

    The latest release, 6.3.6, is not affected.

    9.1% of fast-jwt downloads last week were affected versions (188.3K).

  • fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

    Affected: fixed in 6.3.0.

    Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure).

    The latest release, 6.3.6, is not affected.

    44% of fast-jwt downloads last week were affected versions (908.9K).

  • CVE-2026-107722Critical 9.8

    fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

    Affected: from 6.2.0, fixed in 6.3.0.

    Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure).

    The latest release, 6.3.6, is not affected.

    9.9% of fast-jwt downloads last week were affected versions (203.4K).

  • CVE-2026-107721Medium 5.9

    fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

    Affected: fixed in 6.3.0.

    Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure).

    The latest release, 6.3.6, is not affected.

    44% of fast-jwt downloads last week were affected versions (908.9K).

  • fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

    Affected: fixed in 6.3.1.

    Fixed in 6.3.1 (released Jul 30, 2026, 70 days before disclosure).

    The latest release, 6.3.6, is not affected.

    45% of fast-jwt downloads last week were affected versions (921.3K).

  • CVE-2026-107719Medium 4.2

    fast-jwt: Verifier cache accepts expired JWTs without iat.

    Affected: fixed in 6.3.4.

    Fixed in 6.3.4 (released Oct 4, 2026, 4 days before disclosure).

    The latest release, 6.3.6, is not affected.

    56% of fast-jwt downloads last week were affected versions (1.2M).

  • CVE-2026-44351Critical 9.1

    fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

    Affected: fixed in 6.2.4.

    Fixed in 6.2.4 (released Apr 29, 2026, 14 days before disclosure).

    The latest release, 6.3.6, is not affected.

    35% of fast-jwt downloads last week were affected versions (720.6K).

  • CVE-2026-35041Medium 4.2

    ReDoS in fast-jwt when using RegExp in allowed leading to CPU exhaustion during token verification

    Affected: from 5.0.0, fixed in 6.2.1.

    Fixed in 6.2.1 (released Apr 9, 2026, the day of disclosure).

    The latest release, 6.3.6, is not affected.

    20% of fast-jwt downloads last week were affected versions (409.6K).

  • CVE-2026-35040Medium 5.3

    fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

    Affected: fixed in 6.2.1.

    Fixed in 6.2.1 (released Apr 9, 2026, the day of disclosure).

    The latest release, 6.3.6, is not affected.

    34% of fast-jwt downloads last week were affected versions (707.7K).

  • fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    Affected: through 6.1.0.

    Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 6.3.6, is not affected.

    34% of fast-jwt downloads last week were affected versions (705.5K).

  • CVE-2026-35039Critical 9.1

    fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

    Affected: from 0.0.1, fixed in 6.2.0.

    Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure).

    The latest release, 6.3.6, is not affected.

    34% of fast-jwt downloads last week were affected versions (705.5K).

  • CVE-2026-34950Critical 9.1

    fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

    Affected: fixed in 6.2.0.

    Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure).

    The latest release, 6.3.6, is not affected.

    34% of fast-jwt downloads last week were affected versions (705.5K).

  • CVE-2025-30144Medium 6.5

    Fast-JWT Improperly Validates iss Claims

    Affected: fixed in 5.0.6.

    Fixed in 5.0.6 (released Mar 19, 2025, the day of disclosure).

    The latest release, 6.3.6, is not affected.

    15% of fast-jwt downloads last week were affected versions (305.4K).

  • CVE-2023-48223Medium 5.9

    fast-jwt JWT Algorithm Confusion

    Affected: fixed in 3.3.2.

    Fixed in 3.3.2 (released Nov 20, 2023, the day of disclosure).

    The latest release, 6.3.6, is not affected.

    1.2% of fast-jwt downloads last week were affected versions (24.1K).