CVE-2026-107722
published 2026-10-08CVE-2026-107722: fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key…
PriorityP259critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.27%
18.6th percentile
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nearform | fast-jwt | — | — |
| nearform | fast-jwt | >= 6.2.0 < 6.3.0 | 6.3.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
nearform fast-jwt up to 6.2.x Key Detection src/crypto.js performDetectPublicKeyAlgorithms authorization (EUVD-2026-95347)
vuldb·2026-10-09·CVSS 9.8
CVE-2026-107722 [CRITICAL] nearform fast-jwt up to 6.2.x Key Detection src/crypto.js performDetectPublicKeyAlgorithms authorization (EUVD-2026-95347)
A vulnerability labeled as critical has been found in nearform fast-jwt up to 6.2.x. This issue affects the function performDetectPublicKeyAlgorithms of the file src/crypto.js of the component Key Detection. Such manipulation leads to authorization bypass.
This vulnerability is listed as CVE-2026-107722. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
GHSA
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
ghsa·2026-10-08·CVSS 9.1
CVE-2026-107722 [CRITICAL] CWE-347 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
### Summary
The fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is **incomplete**. It adds `key.trim()` to the PEM-detection path in `src/crypto.js`, but `String.prototype.trim()` only strips characters classified as whitespace by the ECMAScript specification. The subsequent `^`-anchored regex (`/^-----BEGIN(?: (RSA))? PUBLIC KEY-----/`) still requires the PEM header at position 0 — so **any non-whitespace leading byte** (control chars, zero-width unicode, `#` comments, HTTP-style headers, PGP wrappers) bypasses detection and falls through to the HMAC verification path, using the RSA public key as the HMAC shared secret. Net result: the **exact same RSA→HS256 algorithm-c
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfahttps://github.com/nearform/fast-jwt/pull/632https://github.com/nearform/fast-jwt/releases/tag/v6.3.0https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
2026-10-08
Published