Quick answers
- Is CVE-2025-30144 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-30144 being exploited in the wild.
- How severe is CVE-2025-30144?
- Low severity, with a CVSS score of 3.1, published 19 March 2025.
- Which products and versions are affected?
- fast-jwt (npm) SEMVER:introduced=0,fixed=5.0.6.
- Is there a fix for CVE-2025-30144?
- Yes. fast-jwt (npm): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-30144 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-30144?
- Check whether you run fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- fast-jwt (npm): upgrade to 5.0.6 or later
npm install fast-jwt@5.0.6
Technical details
The vulnerability is an improper input validation (CWE-20) flaw in Fast-JWT's iss claim validation logic. According to RFC 7519, the iss claim must be a string; however, Fast-JWT incorrectly accepts an array of strings as a valid iss value. An attacker can craft a JWT with an iss claim structured as ['https://attacker-domain/', 'https://valid-iss'], which will be validated as legitimate. The vulnerability is exploitable over the network with moderate attack complexity, particularly when used alongside libraries like get-jwks that do not independently validate the iss claim. An attacker with no authentication or privileges can forge arbitrary JWT payloads and bypass issuer validation, compromising data integrity and authentication mechanisms.
Affected products
- NearForm Fast-JWT <5.0.6
Identifiers
- CVE-2025-30144
- GHSA-gm45-q3v2-6cf8
Timeline
- 2025-03-19: disclosed
- 2025-03-19: patched: Fixed in version 5.0.6