Astra Linux - vulnerability in ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as the JWT algorithm. Doing so results in the JWT signature being ignored. The vulnerability is most likely present in the RadosGW OIDC provider. At the time of...

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.0...

EUVD-2026-95344

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...