CVE-2026-34950 — Improper Input Validation in Fast-jwt

CWE-20 — Improper Input ValidationCWE-327 — Use of a Broken or Risky Cryptographic Algorithm4 documents4 sources
Severity
9.1CRITICALNVD
GHSA5.9OSV5.9
EPSS
0.0%
top 95.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nearform Fast-jwt
Timeline
Latest updateApr 2
PublishedApr 6

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶npmnearform/fast-jwt< 6.2.0

🔴Vulnerability Details

2
OSV
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key↗2026-04-02
▶
GHSA
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key↗2026-04-02
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-34950 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶