CVE-2026-34950: fallo crítico en nearform fast-jwt
fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.3%
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
nearform · fast-jwtCVEs relacionadas — nearform fast-jwt
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-48223MEDIUMfast-jwt JWT Algorithm ConfusionEPSS 0.7%CVE-2025-30144MEDIUMFast-JWT Improperly Validates iss ClaimsEPSS 0.6%CVE-2026-107723HIGHfast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayEPSS 0.5%CVE-2026-35040MEDIUMfast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)EPSS 0.4%CVE-2026-107722CRITICALfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionEPSS 0.4%CVE-2026-107721MEDIUMfast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)EPSS 0.3%