CVE-2026-107720

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107721

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...

CVE-2026-107719

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.0...

EUVD-2026-95344

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107720

The fast-jwt library (prior to version 6.3.1 ) contains a vulnerability in the createVerifier function where it incorrectly accepts unsigned JWTs. When a falsy synchronous key (such as an empty string or null) is provided alongside a non-empty algorithms allowlist , the library bypasses the prepa...

CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107720 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

EUVD-2026-95343

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

PT-2026-108249

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.1 Description In the createVerifier function, the software fails to properly validate the signing key when it is provided as an empty string or null while a non-empty allowlist is specified in the algorithms...

PT-2026-108248

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.4 Description An expiration-check bypass exists when caching is enabled. The createVerifier cache may continue accepting a signed JSON Web Token JWT after its expiration time if the token contains an exp expirati...