{"id":"EUVD-2026-95344","enisaUuid":"189b626b-a7d5-351d-a399-f91f80a0de0f","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.","datePublished":"Oct 8, 2026, 9:44:06 PM","dateUpdated":"Oct 9, 2026, 2:32:14 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv\nhttps://github.com/nearform/fast-jwt/pull/649\nhttps://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.3.1\n","aliases":"CVE-2026-107720\nGHSA-8wpc-h4q6-8fxv\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"6b61ddd5-79ea-3e68-b161-fdc5c0083ed8","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"\u003c 6.3.1"}],"enisaIdVendor":[{"id":"75f7b079-d7d3-39a7-9d4e-36ab6e88ddc7","vendor":{"name":"nearform"}}],"enisaIdVulnerability":[{"id":"d25243be-93dc-37f9-9f1e-a5cc36daf41f","vulnerability":{"id":"GHSA-8wpc-h4q6-8fxv","description":"fast-jwt: createVerifier accepts unsigned JWTs when key is \u0027\u0027 or null and algorithms is explicitly set","datePublished":"Oct 8, 2026, 10:02:12 PM","dateUpdated":"Oct 8, 2026, 10:02:12 PM","baseScore":0.0,"references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv\nhttps://github.com/nearform/fast-jwt/pull/649\nhttps://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534\nhttps://github.com/nearform/fast-jwt\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.3.1\n","enisa_id":"EUVD-2026-95344\n","aliases":"GHSA-8wpc-h4q6-8fxv\nCVE-2026-107720\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fcbf6759-6bac-33e3-b89c-bdb82a42835f","vulnerability":{"id":"CVE-2026-107720","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.","datePublished":"Oct 8, 2026, 9:44:06 PM","dateUpdated":"Oct 9, 2026, 2:32:14 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv\nhttps://github.com/nearform/fast-jwt/pull/649\nhttps://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.3.1\n","enisa_id":"EUVD-2026-95344\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 1, 2026, 4:04:46 AM","vulnerabilityProduct":[{"id":"802774ec-dfab-325a-8745-21816b493b43","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"\u003c 6.3.1"}],"vulnerabilityVendor":[{"id":"c6bff3f5-ba41-32e2-9b44-d733c43135c4","vendor":{"name":"nearform"}}]}}],"enisaIdAdvisory":[]}