CVE-2025-30144: fast-jwt Auth Bypass Vulnerability

CVE-2025-30144 Overview

CVE-2025-30144 is an authentication bypass vulnerability in the fast-jwt Node.js library, a widely used JSON Web Token (JWT) implementation. Versions prior to 5.0.6 fail to validate the iss (issuer) claim in accordance with RFC 7519, which mandates a StringOrURI value. The library instead accepts an array of strings, letting an attacker embed a malicious issuer alongside a legitimate one. Applications that pair fast-jwt with JWKS fetchers such as get-jwks may accept forged tokens, undermining trust boundaries in identity federation flows. The issue is tracked under [CWE-290: Authentication Bypass by Spoofing] and is fixed in fast-jwt version 5.0.6.

Critical Impact
Attackers can forge JWTs accepted by downstream applications by inserting an attacker-controlled issuer into the iss array claim, enabling authentication bypass and impersonation.

Affected Products

fast-jwt versions prior to 5.0.6
Node.js applications relying on fast-jwt for JWT verification
Applications combining fast-jwt with get-jwks or similar libraries that do not independently validate the iss claim

Discovery Timeline

2025-03-19 - CVE-2025-30144 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30144

Vulnerability Analysis

The fast-jwt verifier accepts an iss claim whose value is an array of strings. RFC 7519 defines the iss claim as a case-sensitive StringOrURI value, not a collection. When the verifier iterates the array and matches any element against the allowed issuer list, tokens containing both an attacker-controlled string and a legitimate issuer pass validation. Downstream JWKS resolvers such as get-jwks then fetch signing keys based on the attacker-controlled entry, allowing the attacker to sign tokens with their own key while retaining a legitimate issuer value that satisfies application-level checks.

Root Cause

The root cause is permissive claim validation in validateClaimValues within src/verifier.js. The function did not distinguish between scalar and array claim values for iss, and did not enforce the RFC 7519 requirement that iss be a single StringOrURI. This is classified as [CWE-290: Authentication Bypass by Spoofing].

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker crafts a JWT with an iss claim structured as ["https://attacker-domain/", "https://valid-iss"], signs it with a key hosted at the attacker domain, and submits it to the victim application. Because fast-jwt accepts the array, and helper libraries retrieve keys from the attacker-controlled JWKS endpoint, the forged token is deemed valid.

javascript

// Patch excerpt from src/verifier.js
function validateClaimValues(values, claim, allowed, arrayValue) {
  const failureMessage = arrayValue
    ? `Not all of the ${claim} claim values are allowed.`
    : `The ${claim} claim value is not allowed.`

  if (!values.every(v => allowed.some(a => a.test(v)))) {
    throw new TokenError(TokenError.codes.invalidClaimValue, failureMessage)
  }
}

function validateClaimArrayValues(values, claim, allowed, arrayValue) {
  const failureMessage = arrayValue
    ? `None of ${claim} claim values are allowed.`
    : `The ${claim} claim value is not allowed.`

Source: GitHub Commit cc26b1d. The fix separates scalar validation from array validation and requires every value in an array claim to match the allowlist.

Detection Methods for CVE-2025-30144

Indicators of Compromise

JWTs observed in application logs with an iss claim of JSON array type rather than a string
Authentication events where the JWKS key ID (kid) resolves to a domain outside the organization's trusted issuer allowlist
Unexpected outbound requests to unknown domains hosting /.well-known/jwks.json endpoints from application servers

Detection Strategies

Inspect decoded JWT payloads at ingress proxies and reject tokens where typeof iss !== 'string'
Audit application dependency manifests (package.json, package-lock.json, yarn.lock) for fast-jwt versions below 5.0.6
Correlate JWKS fetch destinations with an allowlist of approved identity providers and alert on deviations

Monitoring Recommendations

Enable verbose logging of JWT verification failures and successes, capturing the raw iss value type and content
Track outbound HTTPS requests from authentication middleware to detect unexpected JWKS endpoints
Add software composition analysis (SCA) scanning to CI/CD pipelines for continuous detection of vulnerable fast-jwt versions

How to Mitigate CVE-2025-30144

Immediate Actions Required

Upgrade fast-jwt to version 5.0.6 or later across all Node.js services and rebuild container images
Enforce strict iss validation at the application layer by verifying the claim is a string equal to the expected issuer
Restrict JWKS resolution to a hardcoded allowlist of trusted issuer URIs rather than trusting the token's iss value

Patch Information

The maintainers released the fix in fast-jwt5.0.6. See GitHub Security Advisory GHSA-gm45-q3v2-6cf8 and the remediation commit for implementation details. The patch introduces validateClaimArrayValues and enforces that every element in an array claim matches the allowlist.

Workarounds

Wrap fast-jwt verification in application code that rejects tokens where iss is not a scalar string
Configure the verifier's allowedIss option with exact string matches and validate the decoded payload independently before trusting downstream calls
Pin JWKS retrieval to a static configuration rather than deriving the JWKS URI from the token's iss claim

bash

# Upgrade fast-jwt to a patched release
npm install fast-jwt@^5.0.6

# Verify installed version
npm ls fast-jwt

# Audit for remaining vulnerable transitive dependencies
npm audit --production