# CVE-2026-107722: fast-jwt incomplete RSA-to-HS256 algorithm confusion fix

Source: https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107722 · Severity: critical · CVSS 9.8 · Published 2026-10-08

fast-jwt is a Node.js library used to verify JSON Web Tokens (JWTs), the standard credentials for APIs and microservices. A 2026 security patch was meant to close an RSA→HS256 algorithm-confusion attack but only removed leading whitespace; any non-whitespace prefix byte (comments, control characters, zero-width Unicode) still bypasses the fix. An attacker with access to the target's public RSA key can forge arbitrary JWT tokens with any claims (user ID, admin status, etc.) that will be accepted as authentic.

Technologies: [Fast-Jwt](https://junglewise.ai/threats/technologies/fast-jwt-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Fast-Jwt](https://junglewise.ai/threats/vendors/fast-jwt), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107722 being exploited in the wild.

**How severe is CVE-2026-107722?** Critical severity, with a CVSS score of 9.8, published 8 October 2026.

**Which products and versions are affected?** Fast-Jwt 6.2.0 through 6.2.2 (and likely beyond; v6.2.0 introduced the incomplete patch); fast-jwt (npm) >= 6.2.0, <= 6.2.4, SEMVER:introduced=6.2.0,fixed=6.3.0.

**Is there a fix for CVE-2026-107722?** Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Restrict the `algorithms` option in `createVerifier()` to exclude HS256 (e.g., `createVerifier({ key, algorithms: ['RS256', 'ES256'] })`); this forces the library to reject any token that does not match the RSA/EC signature scheme and prevents fallback to HMAC. Alternatively, ensure JWT keys are loaded from trusted sources and sanitized to remove any non-whitespace leading bytes before passing to `createVerifier()`. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107722 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107722?** Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.3.0 or later

  ```sh
  npm install fast-jwt@6.3.0
  ```


Restrict the `algorithms` option in `createVerifier()` to exclude HS256 (e.g., `createVerifier({ key, algorithms: ['RS256', 'ES256'] })`); this forces the library to reject any token that does not match the RSA/EC signature scheme and prevents fallback to HMAC. Alternatively, ensure JWT keys are loaded from trusted sources and sanitized to remove any non-whitespace leading bytes before passing to `createVerifier()`.

## Technical details

The vulnerability is an incomplete patch to CVE-2026-34950 in the `performDetectPublicKeyAlgorithms` function in `src/crypto.js`. The function calls `key.trim()` to strip leading/trailing whitespace, then tests whether the key matches a PEM format using an anchored regex `/^-----BEGIN(?: (RSA))? PUBLIC KEY-----/`. However, `String.prototype.trim()` only removes ECMAScript whitespace (U+0009–U+000D, U+0020, U+00A0, U+1680, U+2000–U+200A, U+2028–U+2029, U+202F, U+205F, U+3000, U+FEFF); any non-whitespace leading byte causes the regex to fail and execution falls through to HMAC verification using the RSA public key as the shared secret. An attacker can exploit this by prefixing a valid PEM key with any non-whitespace control character, zero-width Unicode, or comment syntax to force HMAC mode and forge tokens signed with knowledge of the public key alone. Prerequisites are identical to the original CVE: the target must load its verification key from a source that may contain such a prefix (database, YAML config, clipboard, HTTP response headers, etc.) and must not restrict allowed algorithms to exclude HS256.

## Affected products

- fast-jwt fast-jwt 6.2.0 through 6.2.2 (and likely beyond; v6.2.0 introduced the incomplete patch)

## Identifiers

- CVE-2026-107722
- GHSA-ww5h-9m49-7xx4

## Timeline

- 2026-10-08: disclosed: GHSA-ww5h-9m49-7xx4 published

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)
- [fast-jwt expiration bypass in token caching](https://junglewise.ai/threats/cve-2026-107719-fast-jwt-verifier-cache-accepts-expired-jwts-without-iat)