Design Flaw in JSON Web Token Implementation in Fast-JWT by NearForm

CVE-2025-30144

What is CVE-2025-30144?

The fast-jwt library, a lightweight implementation of JSON Web Tokens, contains a critical design flaw that improperly validates the 'iss' (issuer) claim according to the standards set by RFC 7519. Before version 5.0.6, the library erroneously accepted an array of strings as a valid issuer value. This flaw allows attackers to construct a malicious JWT with a crafted 'iss' array that includes both a valid issuer and their own domain. If applications relying on fast-jwt also use external libraries that do not validate the 'iss' claim independently, the attacker could successfully forge a JWT that appears legitimate, subsequently granting unauthorized access to sensitive functionalities or data within the application. This vulnerability poses severe risks, especially if exploited by targeting applications that incorrectly trust JWTs.

References