CVE-2025-30144

概要 fast-jwt ライブラリは、RFC https://datatracker.ietf.org/doc/html/rfc7519page-9 に基づく iss クレームの検証を適切に行いません。 詳細 fast-jwt ライブラリ内の iss（発行者）クレーム検証は、文字列の配列を有効な iss 値として許可します。この設計上の欠陥により、悪意のある攻撃者が 'https://attacker-domain/', 'https://valid-iss' のような構造の iss クレームを持つ JWT を作成する、潜在的な攻撃が可能になります。寛容な検証のため、その JWT...

CVE-2026-44351-poc

CVE-2026-44351 — 空のSecretによるJWT偽造 fast-jwt fast-jwt 6.2.4より前のバージョン における認証バイパス auth bypass のPoC。 これにより、未認証の攻撃者が任意のJWTを偽造し、標的アプリケーションによって 正規のものとして受け入れさせることができる。...

CVE-2023-48223

CVE-2023-48223 PoC（fast-jwt アルゴリズム混乱） このリポジトリは、トークン検証時に許可されたアルゴリズムをロックしていない fast-jwt における JWT アルゴリズム混乱（algorithm confusion）を実演します。 環境構築 必要条件 Node.js 18 以降 npm OpenSSL（ターミナルの PATH で利用可能である必要があります） 1 依存関係のインストール プロジェクトのルートから次を実行してください: root@kitploit: npm install 2 RSA キーの生成 このアプリは次のファイルを必要とします:...

Exploit for CVE-2026-44351

CVE-2026-44351 — Falsificación de JWT por Secret Vacío en fas...

CVE-2026-35041

fast-jwt provides fast JSON Web Token JWT implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the...

CVE-2026-44351

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

CVE-2026-44351

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

CVE-2026-44351

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

CVE-2026-44351

CVE-2026-44351 — fast-jwt auth bypass (pre-6.2.4) : The vulnerability exists in fast-jwt’s async key-resolver flow when the resolver returns an empty string or zero-length Buffer. The library may treat this as a valid secret and derive allowedAlgorithms as HS256/HS384/HS512, then verify a JWT aga...

fast-jwt 授权问题漏洞

fast-jwt is a JSON Web Token implementation open-sourced by Nearform. Versions of fast-jwt prior to 6.2.4 contained an authorization vulnerability. This vulnerability stemmed from a critical authentication bypass in the asynchronous key resolution process, allowing unauthenticated attackers to...

CVE-2026-44351: Improper Authentication

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: SNYK:JS-FASTJWT-16439016...

NPM: fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

NPM: fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.3...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: OSV:GHSA-GMVF-9V4P-V8JC...

GHSA-GMVF-9V4P-V8JC fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

Summary A critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string '', for example via the common keysdecoded.header.ki...

CVE-2026-44351

creationtimestamp| type| source ---|---|--- 2026-04-29 11:07:21+00:00| published-proof-of-concept| https://github.com/nearform/fast-jwt/security/advisories/GHSA-gmvf-9v4p-v8jc...

Regular Expression Denial Of Service

fast-jwt is vulnerable to Regular Expression Denial of Service. The vulnerability is due to the library allowing regular expressions in claim validation, where a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during...

CVE-2026-35040

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are statef...