CVE-2026-107722: fast-jwt Incomplete Patch Enables RSA to HS256 Algorithm Confusion
Summary
CVE-2026-107722: The fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is incomplete. Affects fast-jwt versions >= 6.2.0, < 6.3.0. Fixed in 6.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-jwt is a popular library in the Node.js ecosystem used for creating and verifying JSON Web Tokens (JWTs). It provides a simple and efficient way to handle JWTs, making it a preferred choice for many Fastify-based APIs. However, it has a critical vulnerability that affects its security, particularly in how it handles public RSA keys during verification.
Vulnerability Detail
The vulnerability arises from an incomplete patch of a previous issue (CVE-2026-34950). The fix introduced a method to trim whitespace from the key input, but it failed to account for non-whitespace leading characters. This oversight allows attackers to prepend non-whitespace bytes to the RSA public key, bypassing the intended PEM header detection. As a result, the library may treat the RSA key as an HMAC shared secret, enabling an attacker to forge JWTs with arbitrary claims, including admin privileges. The attack prerequisites are similar to the original CVE, requiring the attacker to know the target's public RSA key and to load it from a source that may contain non-whitespace prefixes.
How To Fix
Latest published version: 6.3.5 as of 22 Oct 2026
npm install fast-jwt@6.3.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.3.0
This is the first release that contains the fix.
npm install fast-jwt@6.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing a workaround by modifying the key detection logic. For example, you can locate the PEM block instead of anchoring on position 0:
const pemStart = trimmedKey.indexOf('-----BEGIN');
if (pemStart !== -1 && publicKeyPemMatcher.test(trimmedKey.slice(pemStart))) { ... }
This change ensures that any leading content does not interfere with the PEM header detection.
Conclusion
The fast-jwt library has a critical vulnerability that can be exploited to forge JWTs due to improper handling of RSA public keys. It is essential to update to version 6.3.0 or later to mitigate this risk. Users should also consider implementing workarounds if immediate updates are not feasible.
See every vulnerability recorded for fast-jwt →
FAQ
CVE-2026-107722 is a critical vulnerability in the fast-jwt library that allows attackers to forge JWTs by exploiting improper handling of RSA public keys.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without signup.
The vulnerability can lead to authentication bypass, allowing attackers to forge JWTs with arbitrary claims, potentially gaining unauthorized access to sensitive resources.
If immediate updates are not possible, implement the suggested workaround to modify the key detection logic until you can upgrade to the patched version.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-jwt.
