p PatchFirst

CVE-2026-107724

CVE-2026-107724 · fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

CVSS 7.4 · Alta · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • fast-jwt

    Versiones
    • >= 6.2.4, < 6.3.0: Afectada

    Sin corrección publicada

  • fast-jwt npm

    Versiones
    • 6.2.4
    Intervalos de versiones afectados
    • SEMVER: ≥ 6.2.4, < 6.3.0

    Actualiza a 6.3.0

Fuentes originales

Comprueba tu servidor →