Vulnerability in Nearform Fast-jwt
CVE-2025-30144
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array…
EPSS: 0.021 (84.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Nearform Fast-jwt — versions < 5.0.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8 (x_refsource_CONFIRM)
- https://github.com/nearform/fast-jwt/commit/cc26b1d473f900446ad846f8f0b10eb1c0adcbdd (x_refsource_MISC)
- https://datatracker.ietf.org/doc/html/rfc7519#page-9 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-30144?
- CVE-2025-30144 is a medium-severity vulnerability in Nearform Fast-jwt, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.5/10. Published 2025-03-19.
- How severe is CVE-2025-30144?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-30144 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.