CVE-2026-107722

{
  "etk_id": "ETK-2026-1020",
  "cve_id": "CVE-2026-107722",
  "display_id": "CVE-2026-107722",
  "ghsa_id": "GHSA-ww5h-9m49-7xx4",
  "euvd_id": "EUVD-2026-95347",
  "status": "published",
  "anchor_state": "anchored",
  "title": "RSA-to-HMAC algorithm confusion in fast-jwt",
  "summary": "fast-jwt versions 6.2.0 through 6.2.2 can misidentify an RSA public key as an HMAC key when non-whitespace data precedes its PEM header. An attacker who knows the public key may forge JWT claims if the verifier allows or infers HS256 and loads a key with such a prefix.",
  "mitigation": "Upgrade fast-jwt to version 6.3.0 or later. Until upgraded, explicitly allow only the required asymmetric verification algorithms, such as RS256, and ensure loaded PEM keys contain no leading wrapper or metadata content.",
  "vendor": "npm",
  "product": "npm:fast-jwt",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.2.0, <= 6.2.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "6.3.0"
      ],
      "package_name": "fast-jwt",
      "purl": "pkg:npm/fast-jwt"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0027,
  "epss_percentile": 0.1837,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.704559866666667,
  "t0_at": "2026-10-08T21:49:55.888000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-08T22:02:07+00:00",
      "days": 0.008461944444444444,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T21:49:55.888000+00:00",
      "url": "https://github.com/advisories/GHSA-ww5h-9m49-7xx4"
    },
    "trigger_signal": {
      "at": "2026-10-08T21:49:55.888000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T21:49:55.888000+00:00",
      "url": "https://github.com/advisories/GHSA-ww5h-9m49-7xx4"
    }
  }
}