nearform fast-jwt up to 6.2.x Key Algorithm Detection src/crypto.js performDetectPublicKeyAlgorithms deserialization

Summaryinfo

A vulnerability was found in nearform fast-jwt up to 6.2.x. It has been rated as critical. This issue affects the function performDetectPublicKeyAlgorithms of the file src/crypto.js of the component Key Algorithm Detection. This manipulation causes deserialization. The identification of this vulnerability is CVE-2026-107724. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in nearform fast-jwt up to 6.2.x. Affected by this vulnerability is the function performDetectPublicKeyAlgorithms of the file src/crypto.js of the component Key Algorithm Detection. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-107724 since 10/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• nearform

Name

• fast-jwt

Version

• 6.0
• 6.1
• 6.2

Website

• Product: https://github.com/nearform/fast-jwt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion