CVE-2026-107724 Details
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.
A vulnerability in fast-jwt version 6.2.4 allows raw public JWK or JWKS JSON to be incorrectly classified as HMAC secret material. This misclassification occurs because the library's public key detection logic treats non-PEM strings as symmetric keys. If HS256 is permitted or inferred, an attacker can use the public key bytes to forge a JWT by signing it with an HS256 HMAC key, which fast-jwt would accept as valid. The vulnerability arises from the improper handling of public key data, which is publicly available by design, enabling exploitation by anyone aware of the serialized key. The issue has been resolved in fast-jwt version 6.3.0.
Users can upgrade to fast-jwt version 6.3.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf | [email protected] | Source CodeVendor |
| https://github.com/nearform/fast-jwt/pull/636 | [email protected] | Source CodeVendor |
| https://github.com/nearform/fast-jwt/releases/tag/v6.3.0 | [email protected] | Release NotesVendor |
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fast-jwt | = 6.2.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |