{"id":"EUVD-2026-19356","enisaUuid":"cda34cf4-360e-3d7c-8fa8-3ed95b60ab87","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","datePublished":"Apr 6, 2026, 3:54:03 PM","dateUpdated":"Apr 6, 2026, 6:43:16 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987\n","aliases":"CVE-2026-34950\nGHSA-mvf2-f6gm-w987\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"c4a77927-9b60-3985-8698-157fb7fbba6f","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"≤ 6.1.0"}],"enisaIdVendor":[{"id":"da22df1b-96cb-33ac-ae44-09a85205cc45","vendor":{"name":"nearform"}}],"enisaIdVulnerability":[{"id":"5f97669e-04f4-310f-b794-321302bfb4a7","vulnerability":{"id":"CVE-2026-34950","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.","datePublished":"Apr 6, 2026, 3:54:03 PM","dateUpdated":"Apr 6, 2026, 6:43:16 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987\n","enisa_id":"EUVD-2026-19356\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Oct 30, 2026, 7:19:03 AM","vulnerabilityProduct":[{"id":"bd413f1f-45c9-308f-a4e0-b2fcad67029e","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"≤ 6.1.0"}],"vulnerabilityVendor":[{"id":"c1cab6cc-99b2-3986-a877-0cf14c56dea8","vendor":{"name":"nearform"}}]}},{"id":"cda20994-edfa-343f-b3d2-68025fc4a72a","vulnerability":{"id":"GHSA-mvf2-f6gm-w987","description":"fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","datePublished":"Apr 2, 2026, 8:37:54 PM","dateUpdated":"Apr 7, 2026, 5:06:17 PM","baseScore":0.0,"references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34950\nhttps://github.com/advisories/GHSA-c2ff-88x2-x9pg\nhttps://github.com/nearform/fast-jwt\n","enisa_id":"EUVD-2026-19356\n","aliases":"GHSA-mvf2-f6gm-w987\nCVE-2026-34950\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}