[ Vendor · 6 CVEs ]
nearform
CVEs affecting nearform published in the last 30 days, plus any nearform CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107720 | 8 Oct 2026 | CVSS 7.4 | fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setfast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty… | Fix |
| CVE-2026-107721 | 8 Oct 2026 | CVSS 5.9 | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its… | Fix |
| CVE-2026-107722 | 8 Oct 2026 | CVSS 9.8 | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionfast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret… | Fix |
| CVE-2026-107723 | 8 Oct 2026 | CVSS 8.1 | fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayfast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a… | Fix |
| CVE-2026-107724 | 8 Oct 2026 | CVSS 7.4 | fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryfast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret… | Fix |
| CVE-2026-107719 | 8 Oct 2026 | CVSS 4.2 | fast-jwt: Verifier cache accepts expired JWTs without iat.fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously… | Fix |