{"id":"CVE-2026-34950","revision":"c5e79f00378e47878c648789aff17f3d","records":[{"revision":"c5e79f00378e47878c648789aff17f3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-34950","aliases":[],"title":"fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","state":0,"publishedAt":"2026-04-06T15:54:03.765+00:00","modifiedAt":"2026-04-06T18:43:16.088+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-jwt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nearform\",\n                    \"product\": \"fast-jwt\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 6.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34950","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-34950","identifiers":["CVE-2026-34950"]},"retained":false,"historicalAffected":[]}],"coverage":[]}