fast-jwt: Algorithm confusion via key prefix allows HS256 token forgery
Summary
fast-jwt fails to detect RSA public keys when non-whitespace content, such as comments, control characters, zero-width characters or wrapper text, precedes the PEM header. Such a key is then treated as an HMAC secret. An attacker who knows the public key can sign arbitrary HS256 claims with it, which leads to authentication or authorization bypass. The attack requires that HS256 is inferred or allowed, and an asymmetric-only algorithm allowlist prevents it. This is an incomplete fix of CVE-2026-34950.
Affected
- fast-jwt versions 6.2.0 up to, but not including, 6.3.0
- Versions below 6.2.0: Unknown.
Fixed in
- Upgrade to fast-jwt 6.3.0 or later. Newer 6.3.x releases exist; use the newest stable 6.3.x version.
Workaround
- Restrict the accepted algorithms to asymmetric algorithms only (for example RS256 or ES256) so that the HMAC fallback is never reached.
- No other official workaround is known. Do not clean keys manually.
Exploitation
- Public proof of concept: yes. CISA SSVC lists exploitation as 'poc' and automatable as 'yes'.
- Active exploitation: No evidence found. Not verified against the CISA KEV catalogue.
Our recommendation
- Check whether fast-jwt is used directly or indirectly (for example through @fastify/jwt) and which version is installed.
- Upgrade to the newest stable 6.3.x version and redeploy affected services.
- Until the upgrade is done, enforce an asymmetric-only algorithm allowlist in JWT verification.
- Review logs for unexpected HS256 tokens and for access by unknown accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit d96bbc6 (nearform/fast-jwt) github.com
- Pull Request #632 (nearform/fast-jwt) github.com
- Release v6.3.0 (nearform/fast-jwt) github.com
- Vendor advisory GHSA-ww5h-9m49-7xx4 (nearform/fast-jwt) github.com
- GitHub Advisory GHSA-ww5h-9m49-7xx4 github.com
- OSV record CVE-2026-107722 osv.dev
- Analysis: the fast-jwt fix for algorithm confusion missed the prefix dev.to
- fast-jwt on npm www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:17.
Original description (NVD)
fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.
NVD references (5)
- https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
- https://github.com/nearform/fast-jwt/pull/632
- https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.