5519 matches found
CLEANSTART-2026-PV08936 fast-uri is a URI parser for Node
Security vulnerability affects the n8n package. fast-uri is a URI parser for Node...
CLEANSTART-2026-US61275 fast-uri is a URI parser for Node
Security vulnerability affects the n8n package. fast-uri is a URI parser for Node...
CLEANSTART-2026-OU85538 fast-uri is a URI parser for Node
Security vulnerability affects the n8n package. fast-uri is a URI parser for Node...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to XML Injection.
Summary fast-xml-builder is used by IBM Storage Fusion Data Foundation, which could cause XML Injection. CVE-2026-44665. Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service
Summary fast-xml-parser is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-27942, CVE-2026-26278, CVE-2026-33036 Vulnerability Details CVEID:CVE-2026-27942 DESCRIPTION: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML fro...
CVE-2026-98374
A flaw was found in the Linux kernel's TCP networking subsystem. When replacing packet buffers during connection establishment, the kernel frees memory without updating an internal retransmission pointer, resulting in a use-after-free vulnerability. An unprivileged local user can exploit this...
Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-21933 DESCRIPTION: Java SE could allow a remote attacker to bypass security controls and perform unauthorized update, insert, delete, or read operations on...
Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.
Summary fast-xml-parser is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-73569. Vulnerability Details CVEID:CVE-2026-73569 DESCRIPTION: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until...
CVE-2026-107724
fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...
CVE-2026-107722
fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...
CVE-2026-107720
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...
CVE-2026-107721
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...
CVE-2026-107723
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...
CVE-2026-107719
fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...
Insufficient Session Expiration
Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...
@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)
fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: OSV:GHSA-X937-HJ6V-793P...
NPM: fast-jwt: Verifier cache accepts expired JWTs without iat.
NPM: fast-jwt: Verifier cache accepts expired JWTs without iat. vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.3...
@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)
fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: GHSA-X937-HJ6V-793P...
fast-jwt: Verifier cache accepts expired JWTs without iat.
Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...
@jsprismarine/client (>=0.1.0-rc.50, <=0.14.2), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.14.2) +2 more potentially affected by CVE-2026-107719 via fast-jwt (>=6.0.0, <=6.3.3)
fast-jwt NPM version =6.0.0, =0.1.0-rc.50, =0.12.2-unstable-20250320195345, =0.1.0-rc.50, =0.1.0-rc.50, =0.1.0-rc.52 Source cves: CVE-2026-107719 Source advisory: SNYK:JS-FASTJWT-20825051...