CVE-2026-107724

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

• CWE-347

• https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf
• https://github.com/nearform/fast-jwt/pull/636
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx

Published

Oct 8, 2026

Last Modified

Oct 9, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107719fast-jwt provides fast JSON Web Token (JWT) implementation. …4.2
• CVE-2026-10772Rejected reason: ** DUPLICATE ** This CVE Record has been re…
• CVE-2026-107720fast-jwt provides fast JSON Web Token (JWT) implementation. …7.4
• CVE-2026-107721fast-jwt provides fast JSON Web Token (JWT) implementation. …5.9
• CVE-2026-107722fast-jwt provides fast JSON Web Token (JWT) implementation. …9.8
• CVE-2026-107723fast-jwt provides fast JSON Web Token (JWT) implementation. …8.1
• CVE-2026-107725Hazelcast is a unified real-time data platform combining str…8.7
• CVE-2026-107726Hazelcast is a unified real-time data platform combining str…9.3
• CVE-2026-107727Strawberry GraphQL is a library for creating GraphQL APIs. F…3.7
• CVE-2026-107728Strawberry GraphQL is a library for creating GraphQL APIs. F…7.5
• CVE-2026-107729SumatraPDF is a multi-format reader for Windows. In 3.7.0.22…5.5
• CVE-2026-10773The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsy…5.4