Patch Forecast
Amber warning
Patch this week.

CVE-2026-107722 · GHSA-ww5h-9m49-7xx4

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Risk score
72/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.3%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anc…
Affected
fast-jwt (npm) >= 6.2.0, <= 6.2.4
Fix
Upgrade fast-jwt to 6.3.0 or later.
Exploitation
No known exploitation

Story map

Story map: fast-jwtTHE FLAWSTHE FIXCVE-2026-107722Incomplete patch ofCVE-2026-34950:Non-whitespace key-prefix…CVSS 9.8 · EPSS 0%CVE-2026-107723Fast-jwt : Silentclaim-validator bypass whenJWT payload is a JSON arrayCVSS 8.1 · EPSS 0%CVE-2026-107720CreateVerifier acceptsunsigned JWTs when key is '' ornull and algorithms is…CVSS 7.4 · EPSS 0%CVE-2026-107724Fast-jwt treats raw publicJWK JSON as an HMAC secret,enabling HS256 token forgeryCVSS 7.4 · EPSS 0%Upgrade fast-jwt6.3.0 · 6.3.1or later on your release lineWho is exposedfast-jwt (npm) >= 6.2.0, <=6.2.4AMBER · PATCH THIS WEEKfast-jwtfast-jwt provides fast JSONWeb Token (JWT)implementation. From 6.2.0 until6.3.0, fast-jwt can misclassifyRSA public-key text as an HMACsecret when the key hasnon-whitespace content before…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-347 (CWE-347)66 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

fast-jwt: Amber, patch this week. fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anc…

The flaws

  • CVE-2026-107722: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion (CVSS 9.8 · EPSS 0%)
  • CVE-2026-107723: Fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array (CVSS 8.1 · EPSS 0%)
  • CVE-2026-107720: CreateVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set (CVSS 7.4 · EPSS 0%)
  • CVE-2026-107724: Fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery (CVSS 7.4 · EPSS 0%)

The fix

Upgrade fast-jwt: 6.3.0 · 6.3.1 or later on your release line

Who is exposed: fast-jwt (npm) >= 6.2.0, <= 6.2.4

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
fast-jwtnpm>= 6.2.0, <= 6.2.46.3.0

References

Original description

fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.