CVE-2026-107719 fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

CVE-2026-107719 fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

SUSE CVE-2026-98255

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...

CLEANSTART-2026-YB63066 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-NC17726 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-GL35722 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-AH49048 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-QL19617 fast-uri serializes the port component of a URI without validating it

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

CLEANSTART-2026-YR10396 fast-uri before 4

Security vulnerability affects the langfuse package. fast-uri before 4...

CVE-2026-107722: Improper Verification of Cryptographic Signature

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107719: Insufficient Session Expiration

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

CVE-2026-107721: Insufficient Session Expiration

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...

PT-2026-108248

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.4 Description An expiration-check bypass exists when caching is enabled. The createVerifier cache may continue accepting a signed JSON Web Token JWT after its expiration time if the token contains an exp expirati...

PT-2026-108251

Name of the Vulnerable Software and Affected Versions fast-jwt versions 6.2.0 through 6.2.x Description fast-jwt can misclassify an RSA public key as an HMAC secret if the key contains non-whitespace content such as control characters, zero-width characters, comments, or wrapper text before its P...

PT-2026-108252

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.0 Description The createVerifier function in fast-jwt fails to properly validate that the JSON Web Token JWT payload is a JSON object. Because JavaScript treats arrays as objects, a validly signed JWT with a JSON...

PT-2026-108249

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.1 Description In the createVerifier function, the software fails to properly validate the signing key when it is provided as an empty string or null while a non-empty allowlist is specified in the algorithms...

PT-2026-108250

Name of the Vulnerable Software and Affected Versions fast-jwt versions 1.5.1 through 6.2.x Description The createVerifier function fails to properly validate the clockTolerance option, accepting Infinity as a valid input. This occurs because the validation logic only checks if the value is a...

PT-2026-108253

Name of the Vulnerable Software and Affected Versions fast-jwt version 6.2.4 Description An issue exists where raw serialized public JSON Web Key JWK or JSON Web Key Set JWKS JSON is incorrectly classified as an HMAC secret. This occurs because the performDetectPublicKeyAlgorithms function in...

CVE-2026-107720: Improper Input Validation

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

CVE-2026-107723: Improper Validation of Specified Type of Input

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...