# fast-jwt (npm) vulnerabilities 14 known vulnerabilities (4 critical, 4 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.3.6 (Oct 26, 2026): no advisory affects it - Newest unaffected release: 6.3.6 (Oct 26, 2026), the latest release - Weekly downloads: 1.9M - Dependents: 150 - Releases: 73 since 0.1.0 (Jun 23, 2020) - Registry: https://www.npmjs.com/package/fast-jwt - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107724: 6.2.4 (6.3.0 is outside it) - CVE-2026-107723: 0.1.0 to 6.2.4 (6.3.0 is outside it) - CVE-2026-107722: 6.2.0 to 6.2.4 (6.3.0 is outside it) - CVE-2026-107721: 0.1.0 to 6.2.4 (6.3.0 is outside it) - CVE-2026-107720: 0.1.0 to 6.3.0 (6.3.1 is outside it) - CVE-2026-107719: 0.1.0 to 6.3.3 (6.3.4 is outside it) - CVE-2026-44351: 0.1.0 to 6.2.3 (6.2.4 is outside it) - CVE-2026-35041: 5.0.0 to 6.2.0 (6.2.1 is outside it) - CVE-2026-35040: 0.1.0 to 6.2.0 (6.2.1 is outside it) - CVE-2026-35042: 0.1.0 to 6.1.0 (6.2.0 is outside it) - CVE-2026-35039: 0.1.0 to 6.1.0 (6.2.0 is outside it) - CVE-2026-34950: 0.1.0 to 6.1.0 (6.2.0 is outside it) - CVE-2025-30144: 0.1.0 to 5.0.5 (5.0.6 is outside it) - CVE-2023-48223: 0.1.0 to 3.3.1 (3.3.2 is outside it) ## Advisories (14) ### [CVE-2026-107724](https://cve.now/CVE-2026-107724): fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery - Severity: High 7.4 - Published: Oct 8, 2026 - Affected: from 6.2.4, fixed in 6.3.0. - Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure). - The latest release, 6.3.6, is not affected. - 9.1% of fast-jwt downloads last week were affected versions (188.3K). ### [CVE-2026-107723](https://cve.now/CVE-2026-107723): fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array - Severity: High 8.1 - Published: Oct 8, 2026 - Affected: fixed in 6.3.0. - Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure). - The latest release, 6.3.6, is not affected. - 44% of fast-jwt downloads last week were affected versions (908.9K). ### [CVE-2026-107722](https://cve.now/CVE-2026-107722): fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion - Severity: Critical 9.8 - Published: Oct 8, 2026 - Affected: from 6.2.0, fixed in 6.3.0. - Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure). - The latest release, 6.3.6, is not affected. - 9.9% of fast-jwt downloads last week were affected versions (203.4K). ### [CVE-2026-107721](https://cve.now/CVE-2026-107721): fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) - Severity: Medium 5.9 - Published: Oct 8, 2026 - Affected: fixed in 6.3.0. - Fixed in 6.3.0 (released Jul 28, 2026, 72 days before disclosure). - The latest release, 6.3.6, is not affected. - 44% of fast-jwt downloads last week were affected versions (908.9K). ### [CVE-2026-107720](https://cve.now/CVE-2026-107720): fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set - Severity: High 7.4 - Published: Oct 8, 2026 - Affected: fixed in 6.3.1. - Fixed in 6.3.1 (released Jul 30, 2026, 70 days before disclosure). - The latest release, 6.3.6, is not affected. - 45% of fast-jwt downloads last week were affected versions (921.3K). ### [CVE-2026-107719](https://cve.now/CVE-2026-107719): fast-jwt: Verifier cache accepts expired JWTs without iat. - Severity: Medium 4.2 - Published: Oct 8, 2026 - Affected: fixed in 6.3.4. - Fixed in 6.3.4 (released Oct 4, 2026, 4 days before disclosure). - The latest release, 6.3.6, is not affected. - 56% of fast-jwt downloads last week were affected versions (1.2M). ### [CVE-2026-44351](https://cve.now/CVE-2026-44351): fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass - Severity: Critical 9.1 - Published: May 13, 2026 - Affected: fixed in 6.2.4. - Fixed in 6.2.4 (released Apr 29, 2026, 14 days before disclosure). - The latest release, 6.3.6, is not affected. - 35% of fast-jwt downloads last week were affected versions (720.6K). ### [CVE-2026-35041](https://cve.now/CVE-2026-35041): ReDoS in fast-jwt when using RegExp in allowed leading to CPU exhaustion during token verification - Severity: Medium 4.2 - Published: Apr 9, 2026 - Affected: from 5.0.0, fixed in 6.2.1. - Fixed in 6.2.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 6.3.6, is not affected. - 20% of fast-jwt downloads last week were affected versions (409.6K). ### [CVE-2026-35040](https://cve.now/CVE-2026-35040): fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) - Severity: Medium 5.3 - Published: Apr 9, 2026 - Affected: fixed in 6.2.1. - Fixed in 6.2.1 (released Apr 9, 2026, the day of disclosure). - The latest release, 6.3.6, is not affected. - 34% of fast-jwt downloads last week were affected versions (707.7K). ### [CVE-2026-35042](https://cve.now/CVE-2026-35042): fast-jwt accepts unknown \`crit\` header extensions (RFC 7515 §4.1.11 MUST violation) - Severity: High 7.5 - Published: Apr 6, 2026 - Affected: through 6.1.0. - Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 6.3.6, is not affected. - 34% of fast-jwt downloads last week were affected versions (705.5K). ### [CVE-2026-35039](https://cve.now/CVE-2026-35039): fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) - Severity: Critical 9.1 - Published: Apr 6, 2026 - Affected: from 0.0.1, fixed in 6.2.0. - Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure). - The latest release, 6.3.6, is not affected. - 34% of fast-jwt downloads last week were affected versions (705.5K). ### [CVE-2026-34950](https://cve.now/CVE-2026-34950): fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key - Severity: Critical 9.1 - Published: Apr 6, 2026 - Affected: fixed in 6.2.0. - Fixed in 6.2.0 (released Apr 7, 2026, 1 day after disclosure). - The latest release, 6.3.6, is not affected. - 34% of fast-jwt downloads last week were affected versions (705.5K). ### [CVE-2025-30144](https://cve.now/CVE-2025-30144): Fast-JWT Improperly Validates iss Claims - Severity: Medium 6.5 - Published: Mar 19, 2025 - Affected: fixed in 5.0.6. - Fixed in 5.0.6 (released Mar 19, 2025, the day of disclosure). - The latest release, 6.3.6, is not affected. - 15% of fast-jwt downloads last week were affected versions (305.4K). ### [CVE-2023-48223](https://cve.now/CVE-2023-48223): fast-jwt JWT Algorithm Confusion - Severity: Medium 5.9 - Published: Nov 20, 2023 - Affected: fixed in 3.3.2. - Fixed in 3.3.2 (released Nov 20, 2023, the day of disclosure). - The latest release, 6.3.6, is not affected. - 1.2% of fast-jwt downloads last week were affected versions (24.1K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/fast-jwt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.