AIKIDO-2026-885954
fast-jwt is vulnerable to Authentication Bypass
74
High Risk
This Affects:
fast-jwtTL;DR
The createVerifier factory skips signature verification when the key option is a falsy synchronous value such as an empty string or null while an explicit algorithms allowlist is configured. An unsigned token carrying an empty signature segment falls through both the missing-signature and signature-check guards, so no cryptographic verification runs. Before the fix, such a token with arbitrary claims is accepted as authentic, producing a full authentication and authorization bypass. The fix rejects a falsy key at verifier construction time when an algorithm allowlist is active.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you construct a verifier with an empty or null key while setting an explicit algorithms allowlist.
Background info
fast-jwt is vulnerable to Authentication Bypass in versions 0.0.1 - 6.3.0.
How to fix this
Upgrade the fast-jwt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant