NE
Vendor
nearform
16
CVEs
0
On KEV
6
New 30D
Products
FA9.8
fast-jwt
nearform
14 CVEs0 on KEV6 new
GE9.4
get-jwks
nearform
1 CVEs0 on KEV0 new
UR6.1
Urql
Nearform
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107724 | FA fast-jwt nearform | 7.4 | Oct 8 | fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery |
| CVE-2026-107723 | FA fast-jwt nearform | 8.1 | Oct 8 | fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array |
| CVE-2026-107722 | FA fast-jwt nearform | 9.8 | Oct 8 | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion |
| CVE-2026-107721 | FA fast-jwt nearform | 5.9 | Oct 8 | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) |
| CVE-2026-107720 | FA fast-jwt nearform | 7.4 | Oct 8 | fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set |
| CVE-2026-107719 | FA fast-jwt nearform | 4.2 | Oct 8 | fast-jwt: Verifier cache accepts expired JWTs without iat. |
| CVE-2026-44351 | FA fast-jwt nearform | 9.1 | May 13 | fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass |
| CVE-2026-35041 | FA fast-jwt nearform | 6.5 | Apr 9 | ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification |
| CVE-2026-35040 | FA fast-jwt nearform | 5.3 | Apr 9 | fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) |
| CVE-2026-35042 | FA fast-jwt nearform | 7.5 | Apr 6 | fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) |
| CVE-2026-35039 | FA fast-jwt nearform | 9.1 | Apr 6 | fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) |
| CVE-2026-34950 | FA fast-jwt nearform | 9.1 | Apr 6 | fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key |
| CVE-2025-59936 | GE get-jwks nearform | 9.4 | Sep 27 | get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass |
| CVE-2025-30144 | FA fast-jwt nearform | 6.5 | Mar 19 | Fast-JWT Improperly Validates iss Claims |
| CVE-2024-24556 | UR Urql Nearform | 6.1 | Jan 30 | urql is a GraphQL client that exposes a set of helpers for several frameworks |
| CVE-2023-48223 | FA Fast-jwt Nearform | 5.9 | Nov 20 | fast-jwt provides fast JSON Web Token (JWT) implementation |