{"kind": "product", "path": "vulns/npm/fast-jwt", "name": "fast-jwt", "product": "fast-jwt", "ecosystem": "npm", "items": [{"id": "CVE-2026-107724", "noindex": false, "published": "2026-10-08T21:53:01.909Z", "modified": "2026-10-09T15:51:27.488Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00282, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107724", "title": "fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. Th", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx", "https://github.com/nearform/fast-jwt/pull/636", "https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf"], "fixes": ["6.3.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-107723", "noindex": false, "published": "2026-10-08T21:51:22.183Z", "modified": "2026-10-14T01:25:44.088Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107723", "title": "fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9", "https://github.com/nearform/fast-jwt/pull/639", "https://github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368"], "fixes": ["6.3.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-107722", "noindex": false, "published": "2026-10-08T21:49:55.888Z", "modified": "2026-10-13T16:26:25.790Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107722", "title": "fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymm", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4", "https://github.com/nearform/fast-jwt/pull/632", "https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa"], "fixes": ["6.3.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-107721", "noindex": false, "published": "2026-10-08T21:45:57.545Z", "modified": "2026-10-09T15:13:11.814Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00341, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107721", "title": "fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in v", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-687g-22h4-j4w4", "https://github.com/nearform/fast-jwt/commit/c0fb5b88b4c88ff2bdd194ca2c713599ad9e38b6", "https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"], "fixes": ["6.3.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-107720", "noindex": false, "published": "2026-10-08T21:44:06.843Z", "modified": "2026-10-09T14:32:14.931Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00324, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107720", "title": "fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behav", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv", "https://github.com/nearform/fast-jwt/pull/649", "https://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534"], "fixes": ["6.3.1"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-107719", "noindex": false, "published": "2026-10-08T21:41:55.342Z", "modified": "2026-10-09T15:48:26.096Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00272, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-107719", "title": "fast-jwt: Verifier cache accepts expired JWTs without iat.", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-x937-hj6v-793p", "https://github.com/nearform/fast-jwt/commit/fc1ddbbe5ce38066ba2cea0b0ce0233932757167", "https://github.com/nearform/fast-jwt/releases/tag/v6.3.4"], "fixes": ["6.3.4"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-44351", "noindex": false, "published": "2026-05-13T19:12:33.347Z", "modified": "2026-05-14T18:13:32.626Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.0025, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-44351", "title": "fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-gmvf-9v4p-v8jc", "https://nvd.nist.gov/vuln/detail/CVE-2026-44351"], "fixes": ["6.2.4"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-35041", "noindex": false, "published": "2026-04-09T14:55:22.807Z", "modified": "2026-04-09T16:15:25.352Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35041", "title": "ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf", "https://github.com/nearform/fast-jwt/pull/595", "https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94"], "fixes": ["6.2.1"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-35040", "noindex": false, "published": "2026-04-09T14:52:56.436Z", "modified": "2026-04-13T20:03:41.746Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00383, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35040", "title": "fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication re", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q", "https://github.com/nearform/fast-jwt/pull/593", "https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a"], "fixes": ["6.2.1"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-35042", "noindex": false, "published": "2026-04-06T17:02:12.180Z", "modified": "2026-04-07T15:59:49.872Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35042", "title": "fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6", "https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11", "https://nvd.nist.gov/vuln/detail/CVE-2026-35042"], "fixes": [], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-35039", "noindex": false, "published": "2026-04-06T16:59:43.124Z", "modified": "2026-05-13T15:12:43.989Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35039", "title": "fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg", "https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb", "https://nvd.nist.gov/vuln/detail/CVE-2026-35039"], "fixes": ["6.2.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2026-34950", "noindex": false, "published": "2026-04-06T15:54:03.765Z", "modified": "2026-04-06T18:43:16.088Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00245, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-34950", "title": "fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987", "https://nvd.nist.gov/vuln/detail/CVE-2026-34950"], "fixes": ["6.2.0"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2025-30144", "noindex": false, "published": "2025-03-19T15:41:19.642Z", "modified": "2025-03-19T18:29:22.749Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "medium", "epss": 0.00592, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-30144", "title": "Fast-JWT Improperly Validates iss Claims", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential attack where a malicious actor crafts a JWT with an iss claim structured as ['https://attacker-domain/', 'https://valid-iss']. Due to the permissive validation, the JWT will be deemed valid. Furthermore, if the application relies on external libraries like get-jwks that do not independently validate the iss claim, the attacker can leverag", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8", "https://github.com/nearform/fast-jwt/commit/cc26b1d473f900446ad846f8f0b10eb1c0adcbdd", "https://datatracker.ietf.org/doc/html/rfc7519#page-9"], "fixes": ["5.0.6"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}, {"id": "CVE-2023-48223", "noindex": false, "published": "2023-11-20T17:39:56.816Z", "modified": "2024-08-02T21:23:39.066Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00681, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-48223", "title": "fast-jwt JWT Algorithm Confusion", "description": "fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a ", "references": ["https://github.com/nearform/fast-jwt/security/advisories/GHSA-c2ff-88x2-x9pg", "https://github.com/nearform/fast-jwt/blob/master/src/crypto.js#L29", "https://github.com/nearform/fast-jwt/releases/tag/v3.3.2"], "fixes": ["3.3.2"], "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "fast-jwt", "path": "vulns/npm/fast-jwt", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 6, "kev": 0}, "lastmod": "2026-10-14T01:25:44.088Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}