CVE-2026-107720

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107723

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107721

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...

CVE-2026-107719

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

Improper Verification of Cryptographic Signature

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via createVerifier in src/verifier.js, when an empty string or null is passed as the key option. Because the falsy-key branch skipped key...

GHSA-8WPC-H4Q6-8FXV fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.0...

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

Summary createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value '' or null and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge...

CVE-2026-107723

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

EUVD-2026-95344

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107720

The fast-jwt library (prior to version 6.3.1 ) contains a vulnerability in the createVerifier function where it incorrectly accepts unsigned JWTs. When a falsy synchronous key (such as an empty string or null) is provided alongside a non-empty algorithms allowlist , the library bypasses the prepa...

CVE-2026-107720

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

EUVD-2026-95343

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

PT-2026-108252

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.0 Description The createVerifier function in fast-jwt fails to properly validate that the JSON Web Token JWT payload is a JSON object. Because JavaScript treats arrays as objects, a validly signed JWT with a JSON...

CVE-2026-107723: Improper Validation of Specified Type of Input

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

PT-2026-108634

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

PT-2026-108248

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.4 Description An expiration-check bypass exists when caching is enabled. The createVerifier cache may continue accepting a signed JSON Web Token JWT after its expiration time if the token contains an exp expirati...