fast-jwt

Fast JSON Web Token implementation

Latest 6.3.5

86%

Total Score

healthy

Active, organization-backed project with regular releases, broad contributors, and provenance; all workflow actions are unpinned.

Are you affected? Scan for Free

Health Score Breakdown

Maintainers

The package has seven registry maintainers and is primarily associated with nearform.com, but consumer accounts elizibin (gmail.com) and simoneb (gmail.com), plus outside-domain accounts gbdev13 (gbdev.me) and ryan.roemer (loose-bits.com), create account-hygiene caution. NearForm organizational backing and six active repository contributors partly compensate.

Security policy

No repository security policy was found, leaving vulnerability-reporting guidance less transparent for a security-sensitive JWT library.

Workflow audit

All five workflows were analyzed successfully and scope permissions at job level, with no untrusted checkout or script-injection path. However, all nine action references are unpinned; the low-confidence cache-poisoning finding is hygiene only under the audit rules.

Vulnerabilities

Title	Versions	Severity
CVE-2026-107719 New fast-jwt is vulnerable to Insufficient Session Expiration in versions 0.0.0 - 6.3.3.	0.0.0 - 6.3.3	Medium
AIKIDO-2026-208205 fast-jwt is vulnerable to Insufficient Session Expiration in versions 1.5.0 - 6.2.4.	1.5.0 - 6.2.4	Medium
AIKIDO-2026-394471 fast-jwt is vulnerable to Authorization Bypass in versions 0.0.1 - 6.2.4.	0.0.1 - 6.2.4	High
AIKIDO-2026-885954 fast-jwt is vulnerable to Authentication Bypass in versions 0.0.1 - 6.3.0.	0.0.1 - 6.3.0	High
AIKIDO-2026-957913 fast-jwt is vulnerable to Improper Verification of Cryptographic Signature in versions 6.2.4 - 6.2.4.	6.2.4 - 6.2.4	High

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
asn1.js Version ^5.4.1	—	—
mnemonist Version ^0.40.0	—	—
@lukeed/ms Version ^2.0.2	—	—
safe-regex2 Version ^5.1.0	—	—
ecdsa-sig-formatter Version ^1.0.11	—	—