NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.0, = 6.2.4...

CVE-2026-107722

The fast-jwt library (versions 6.2.0 to 6.3.0 ) is vulnerable to RSA→HS256 algorithm confusion due to an incomplete patch of CVE-2026-34950. The root cause resides in src/crypto.js, where performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored. This allows...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...