CVE-2026-107722

fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.

• CWE-347

• https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
• https://github.com/nearform/fast-jwt/pull/632
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107717Banks generates meaningful LLM prompts using a simple templa…6.5
• CVE-2026-107718AdonisJS HTTP Server is a package for handling HTTP requests…6.1
• CVE-2026-107719fast-jwt provides fast JSON Web Token (JWT) implementation. …4.2
• CVE-2026-10772Rejected reason: ** DUPLICATE ** This CVE Record has been re…
• CVE-2026-107720fast-jwt provides fast JSON Web Token (JWT) implementation. …7.4
• CVE-2026-107721fast-jwt provides fast JSON Web Token (JWT) implementation. …5.9
• CVE-2026-107723fast-jwt provides fast JSON Web Token (JWT) implementation. …8.1
• CVE-2026-107724fast-jwt provides fast JSON Web Token (JWT) implementation. …7.4
• CVE-2026-107725Hazelcast is a unified real-time data platform combining str…8.7
• CVE-2026-107726Hazelcast is a unified real-time data platform combining str…9.3
• CVE-2026-10773The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsy…5.4
• CVE-2026-10774Zephyr's Bluetooth Mesh subnet key management leaks one PSA …6.5