nearform vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20252
3. 202612

Newest CVEs

• CVE-2026-107724

  fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

  nearform · fast-jwt

  High7.4
• CVE-2026-107723

  fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

  nearform · fast-jwt

  High8.1
• CVE-2026-107722

  fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

  nearform · fast-jwt

  Critical9.8
• CVE-2026-107721

  fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

  nearform · fast-jwt

  Medium5.9
• CVE-2026-107720

  fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

  nearform · fast-jwt

  High7.4
• CVE-2026-107719

  fast-jwt: Verifier cache accepts expired JWTs without iat.

  nearform · fast-jwt

  Medium4.2
• CVE-2026-44351

  fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

  nearform · fast-jwt

  Critical9.1
• CVE-2026-35041

  ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

  nearform · fast-jwt

  Medium4.2
• CVE-2026-35040

  fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

  nearform · fast-jwt

  Medium5.3
• CVE-2026-35042

  fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

  nearform · fast-jwt

  High7.5