Vulnerabilities in nearform
9 resultsVexday analysis
A NearForm tem 9 CVEs registradas na base Vexday, com 4 delas críticas, mas nenhuma sob ataque ativo confirmado. A fraqueza dominante é a CWE-345 (Insuficiente Verificação de Autenticação), indicando problemas estruturais em controles de acesso. O risco atual é moderado, com apenas 1 vulnerabilidade publicada nos últimos 90 dias, sugerindo que a maioria das exposições é mais antiga.
CVE-2023-48223MEDIUMfast-jwt JWT Algorithm ConfusionEPSS 0.7%CVE-2025-30144MEDIUMFast-JWT Improperly Validates iss ClaimsEPSS 0.6%CVE-2026-35040MEDIUMfast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)EPSS 0.4%CVE-2025-59936CRITICALget-jwks poisoned JWKS cache allows post-fetch issuer validation bypassEPSS 0.4%CVE-2026-35041MEDIUMReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verificationEPSS 0.3%CVE-2026-44351CRITICALfast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassEPSS 0.2%CVE-2026-34950CRITICALfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public KeyEPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2026-35042HIGHfast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)EPSS 0.2%