CVE-2026-107724

Katalog CVE

CVSS 7.4 · High EPSS 0,22%

Kerentanan Improper Verification of Cryptographic Signature. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.

Rincian

Terbit di NVD

8 Oktober 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Deferred

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf
• https://github.com/nearform/fast-jwt/pull/636
• https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx