Medium
CVE-2026-107719
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filters
High
CVE-2026-107720
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Critical
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Medium
CVE-2026-107721
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
High
CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
High
CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
Critical
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Medium
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
High
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Critical
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Critical
CVE-2026-34950
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Critical
CVE-2025-59936
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Medium
CVE-2025-30144
Fast-JWT Improperly Validates iss Claims
Medium
CVE-2023-48223
JWT Algorithm Confusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.