Can Attackers Forge Tokens in fast-jwt 6.2.x by Bypassing Public Key Detection?

The popular JSON Web Token (JWT) library fast-jwt contains a critical vulnerability in its recent 6.2.x releases that allows attackers to forge authentication tokens. This flaw, tracked as CVE-2026-107722, stems from an incomplete patch for a previous security issue, effectively re-enabling a method for token forgery that was previously addressed.

According to the GitHub advisory GHSA-ww5h-9m49-7xx4, the vulnerability arises because the fix for CVE-2026-34950, released in version 6.2.0, only partially resolved the underlying problem. The original patch added a trimming function to the key input to remove whitespace before checking for a PEM header. However, the subsequent regular expression used to detect the public key format remains anchored to the start of the string. Consequently, any non-whitespace characters placed before the PEM header—such as control characters, zero-width unicode symbols, comments, or wrapper text—prevent the system from recognising the key as a public key.

When the PEM detection fails, the library falls back to treating the input as an HMAC secret. This allows an attacker who possesses the target’s public RSA key to sign arbitrary HS256 claims using that public material. The result is a successful authentication or authorisation bypass. The National Vulnerability Database (NVD) rates this vulnerability as Critical with a CVSS score of 9.8.

Context and Technical Background

The flaw is located in the `performDetectPublicKeyAlgorithms` function within the `src/crypto.js` file of the fast-jwt library. While the `String.prototype.trim()` method successfully removes standard whitespace characters, it does not strip other non-whitespace leading bytes. Because the `publicKeyPemMatcher` regular expression requires the PEM header to begin at position 0, any preceding non-whitespace character causes the match to fail.

This failure triggers the HMAC verification path, where the RSA public key is incorrectly used as the shared secret. The attack prerequisites are identical to the original CVE-2026-34950: the attacker must know the target’s public RSA key, which is inherently public, and the target must load that key from a source that might include a non-whitespace prefix. Examples of such sources include database columns with corrupted encoding, YAML configuration files with inline comments, or keys copied from formatted documents.

Who Is Affected

The vulnerability affects all versions of fast-jwt from 6.2.0 up to and including 6.2.4. According to the GitHub advisory, version 6.3.0 contains the fix. Security teams should verify their current installations, particularly if they have recently updated from versions prior to 6.2.0 in response to the earlier CVE-2026-34950 disclosure.

Our take on the response

The release of version 6.3.0 addresses the incomplete patching of the algorithm confusion vulnerability. Security operations teams should prioritise updating their dependencies to this version to eliminate the risk of token forgery via public key misuse. Given the ease of exploitation and the critical severity, immediate remediation is advised for any systems relying on fast-jwt for authentication.