FA
Product
fast-jwt
14
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 4High 4Medium 6Low 0
Watch
Add fast-jwt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35041 | 6.5 | Apr 9 | ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification Affected: >= 5.0.0, < 6.2.1 |
| CVE-2025-30144 | 6.5 | Mar 19 | Fast-JWT Improperly Validates iss Claims Affected: < 5.0.6 |
| CVE-2026-107721 | 5.9 | Oct 8 | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) Affected: < 6.3.0 |
| CVE-2023-48223 | 5.9 | Nov 20 | fast-jwt JWT Algorithm Confusion Affected: < 3.3.2 |
| CVE-2026-35040 | 5.3 | Apr 9 | fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) Affected: < 6.2.1 |
| CVE-2026-107719 | 4.2 | Oct 8 | fast-jwt: Verifier cache accepts expired JWTs without iat. Affected: < 6.3.4 |
Showing 6