Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Risk score
57/100
CVSS
7.4 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows…
Affected
fast-jwt (npm) = 6.2.4
Fix
Upgrade fast-jwt to 6.3.0 or later.
Exploitation
No known exploitation

Story map

Story map: fast-jwtTHE FLAWSTHE FIXCVE-2026-107724Fast-jwt treats raw publicJWK JSON as an HMAC secret,enabling HS256 token forgeryCVSS 7.4 · EPSS 0%CVE-2026-107722Incomplete patch ofCVE-2026-34950:Non-whitespace key-prefix…CVSS 9.8 · EPSS 0%CVE-2026-107723Fast-jwt : Silentclaim-validator bypass whenJWT payload is a JSON arrayCVSS 8.1 · EPSS 0%CVE-2026-107720CreateVerifier acceptsunsigned JWTs when key is '' ornull and algorithms is…CVSS 7.4 · EPSS 0%Upgrade fast-jwt6.3.0 · 6.3.1or later on your release lineWho is exposedfast-jwt (npm) >= 6.2.0, <=6.2.4AMBER · PATCH THIS WEEKfast-jwtfast-jwt provides fast JSONWeb Token (JWT)implementation. From 6.2.0 until6.3.0, fast-jwt can misclassifyRSA public-key text as an HMACsecret when the key hasnon-whitespace content before…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-347 (CWE-347)66 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

fast-jwt: Amber, patch this week. fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anc…

The flaws

  • CVE-2026-107724: Fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery (CVSS 7.4 · EPSS 0%)
  • CVE-2026-107722: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion (CVSS 9.8 · EPSS 0%)
  • CVE-2026-107723: Fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array (CVSS 8.1 · EPSS 0%)
  • CVE-2026-107720: CreateVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set (CVSS 7.4 · EPSS 0%)

The fix

Upgrade fast-jwt: 6.3.0 · 6.3.1 or later on your release line

Who is exposed: fast-jwt (npm) >= 6.2.0, <= 6.2.4

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.4 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
fast-jwtnpm= 6.2.46.3.0

References

Original description

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.