CVE-2025-30144

Summary

CVE-2025-30144 affects the fast-jwt library, which provides fast implementation of JSON Web Tokens (JWTs). Prior to version 5.0.6, fast-jwt did not strictly validate the issuer (iss) claim according to RFC 7519. This vulnerability allows attackers to insert their own domain into the issuer array, bypassing intended security checks. If the application uses external libraries like get-jwks that do not independently validate the iss claim, the attacker can forge a JWT that will be accepted by the victim application, potentially leading to unauthorized access. This issue has been addressed in version 5.0.6, which now enforces stricter validation of the issuer claim.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.