{"action":"Upgrade fast-jwt to 6.2.4 or later.","affected":[{"fixed":"6.2.4","introduced":"0"}],"component":"fast-jwt","cve_ids":["CVE-2026-44351"],"ecosystem":"npm","epss":0.0025,"exploited":false,"fixed_versions":["6.2.4"],"ghsa_id":"GHSA-gmvf-9v4p-v8jc","id":"tcs_01M5KFS3DG8CMWS26RMP69SBEV","modified_at":"2026-05-14T20:49:42.175667Z","published_at":"2026-05-06T22:26:37Z","references":["https://osv.dev/vulnerability/GHSA-gmvf-9v4p-v8jc","https://github.com/nearform/fast-jwt/security/advisories/GHSA-gmvf-9v4p-v8jc","https://nvd.nist.gov/vuln/detail/CVE-2026-44351","https://github.com/nearform/fast-jwt"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-gmvf-9v4p-v8jc","url":"https://osv.dev/vulnerability/GHSA-gmvf-9v4p-v8jc"}],"summary":"fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver"}