fast-jwt 6.2.0-6.2.4 Reopens Critical Token Forgery; Update to 6.3.0 Now

The popular Node.js JSON Web Token library fast-jwt contains a critical vulnerability that allows attackers to forge authentication tokens. Although the vendor released version 6.2.0 to fix a previous flaw, that update was incomplete. As a result, applications running fast-jwt versions 6.2.0 through 6.2.4 are exposed to the same token forgery attack the patch intended to stop.

In plain English

The vulnerability, tracked as CVE-2026-107722, is rated critical with a CVSS score of 9.8. It stems from how the library identifies encryption keys. When fast-jwt processes a key, it attempts to detect if it is an RSA public key or an HMAC secret. The library uses a regular expression to look for the standard header of a public key file.

The previous fix added a step to trim whitespace from the key before checking for that header. However, the code only removes standard whitespace characters. If the key data contains any non-whitespace character before the header—such as a comment symbol, a control character, or zero-width unicode—the detection fails. The library then assumes the key is an HMAC secret. This allows an attacker who possesses the public key (which is often publicly available) to use it as a secret to sign their own tokens. The application accepts these forged tokens as valid, granting the attacker unauthorized access.

The background

This issue is a regression of CVE-2026-34950, which was addressed in version 6.2.0. According to the GitHub advisory, the fix for the original CVE was insufficient because it relied on `String.prototype.trim()`. This function only strips characters defined as whitespace by the ECMAScript specification. Any other leading byte, such as those found in corrupted database columns, YAML configurations with inline comments, or copy-pasted text from formatted documents, bypasses the detection logic.

The National Vulnerability Database notes that the flaw exists in the `performDetectPublicKeyAlgorithms` function within `src/crypto.js`. The `publicKeyPemMatcher` regex is anchored to the start of the string. Because the trim operation does not remove non-whitespace prefixes, the regex fails to match, and the code falls back to HMAC verification. This effectively re-enables the RSA-to-HS256 algorithm confusion attack.

What changes now

The vendor, nearform, has released version 6.3.0 to address CVE-2026-107722. This update corrects the key detection logic to prevent the fallback to HMAC verification when a public key is present with a non-standard prefix. Organizations using fast-jwt should upgrade to version 6.3.0 or later. Until then, systems running versions 6.2.0 through 6.2.4 remain vulnerable to authentication bypass.

What to do and how to stay safe: fast-jwt

• Audit your Node.js projects to identify any usage of fast-jwt versions between 6.2.0 and 6.2.4.
• Upgrade to fast-jwt version 6.3.0 or newer to apply the vendor’s fix for the key detection flaw.
• Review your key storage and configuration files for any non-whitespace characters or comments that might appear before PEM headers.
• Implement an asymmetric-only algorithm allowlist in your JWT configuration to prevent HMAC algorithm confusion attacks.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of fast-jwt are affected by this vulnerability?

Versions 6.2.0 through 6.2.4 are vulnerable to CVE-2026-107722.

Is there a fix available for this issue?

Yes, version 6.3.0 fixes the vulnerability.

What is the severity of CVE-2026-107722?

It is rated critical with a CVSS score of 9.8.