Vulnerability in Nearform Fast-Jwt
CVE-2026-107724
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Nearform Fast-Jwt — versions >= 6.2.4, < 6.3.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-107724?
- CVE-2026-107724 is a high-severity vulnerability in Nearform Fast-Jwt, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.4/10. Published 2026-10-08.
- How severe is CVE-2026-107724?
- High severity. CVSS v3 base score is 7.4 out of 10.