fast-jwt 6.2.x Patch Reopens Critical JWT Algorithm Confusion Vulnerability

The nearform fast-jwt library contains a critical vulnerability in versions 6.2.0 through 6.2.4 that allows attackers to bypass authentication and authorization controls. According to the National Vulnerability Database (NVD) and GitHub Security Advisory GHSA-ww5h-9m49-7xx4, the flaw enables an attacker to sign arbitrary JSON Web Token (JWT) claims using a public RSA key as an HMAC secret.

The issue stems from an incomplete remediation of CVE-2026-34950, which was patched in version 6.2.0. The original fix attempted to prevent algorithm confusion by trimming whitespace from the provided key before checking for PEM headers. However, the implementation relied on JavaScript's `String.prototype.trim()` method, which only removes characters defined as whitespace by the ECMAScript specification.

Consequently, any non-whitespace character placed before the PEM header—such as control characters, zero-width unicode, comments, or wrapper text—prevents the regular expression from matching the header at position zero. This causes the library to fall back to HMAC verification, treating the RSA public key material as a symmetric secret.

Context and Background

This vulnerability, tracked as CVE-2026-107722, carries a CVSS score of 9.8, rated as critical. It is classified under CWE-347, which pertains to insufficient verification of data authenticity. The attack vector exploits the library's behavior in the `src/crypto.js` file, specifically within the `performDetectPublicKeyAlgorithms` function. The function uses a start-anchored regular expression (`/^-----BEGIN(?: (RSA))? PUBLIC KEY-----/`) to identify public keys. Because the anchor requires the header to begin at index zero, the trimming logic is insufficient if the input contains non-whitespace prefixes.

The GitHub advisory notes that the attack prerequisites are identical to those of the previous CVE. An attacker must know the target's public RSA key, which is inherently public information, and the target must load that key from a source that may contain non-whitespace prefixes. Common scenarios include database columns with corrupted encoding, YAML configuration files with inline comments, or manual copy-pasting from formatted documents. A proof of concept verified on fast-jwt version 6.2.2 demonstrates that the vulnerability can be exploited with minimal effort.

Who Is Affected

Developers and security professionals using the npm package `fast-jwt` are affected if they are running versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, or 6.2.4. The vulnerability is present in any environment where the library processes JWTs and allows HS256 inference or explicitly permits it alongside asymmetric algorithms. The advisory explicitly states that an asymmetric-only algorithm allowlist prevents the attack. However, if the configuration permits HS256 or if the library infers the algorithm based on the key format, the fallback to HMAC verification occurs, enabling the bypass.

What should you do?

The vulnerability is resolved in fast-jwt version 6.3.0. Users of affected versions should upgrade immediately to 6.3.0 or later. Until an upgrade is possible, administrators can mitigate the risk by configuring the library to use an asymmetric-only algorithm allowlist, which prevents the library from falling back to HMAC verification. Organizations should also audit their configuration files and database entries for public keys to ensure they do not contain unexpected leading characters, such as comments or control codes, that could interfere with PEM detection.