FA
Product
fast-jwt
14
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 4High 4Medium 6Low 0
Watch
Add fast-jwt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-107722 | 9.8 | Oct 8 | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion Affected: >= 6.2.0, < 6.3.0 |
| CVE-2026-44351 | 9.1 | May 13 | fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass Affected: < 6.2.4 |
| CVE-2026-35039 | 9.1 | Apr 6 | fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) Affected: >= 0.0.1, < 6.2.0 |
| CVE-2026-34950 | 9.1 | Apr 6 | fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key Affected: <= 6.1.0 |
Showing 4