fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107722 · Microsoft / collected KEV context

EUVD-2026-95347

GHSA-ww5h-9m49-7xx4

cve-program · CVE-2026-107722

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
• https://github.com/nearform/fast-jwt/pull/632
• https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0

euvd · EUVD-2026-95347

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
• https://github.com/nearform/fast-jwt/pull/632
• https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0

nvd · CVE-2026-107722

• https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
• https://github.com/nearform/fast-jwt/pull/632
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4

osv · GHSA-ww5h-9m49-7xx4

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4
• https://github.com/nearform/fast-jwt/pull/632
• https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa
• https://github.com/nearform/fast-jwt
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0

No related operational record is retained in the current change model.