fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

{
  "id": "7eac6e08b4cd9f84bbb0657329f41ec218dcd68c660b4a7953391801e02c7931",
  "url": "https://osv.dev/vulnerability/GHSA-g3jj-5cmm-3hxx",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery",
    "summary": "### Summary `fast-jwt` 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and create an arbitrary HS256 token that `fast-jwt` accepts as valid. This can result in authentication or authorization bypass through forged JWT claims. The PoC demonstrates the issue with a serialized RSA public JWK. The same non-PEM classification also applies to raw JWKS JSON text, although the attached standalone PoC focuses on the smallest JWK case. ### Details The verifier accepts a string or Buffer as key material. In `src/crypto.js`, `performDetectPublicKeyAlgorithms()` attempts to infer the permitted algorithm family from the supplied string. Strings matching supported PEM public-key formats are classified as asymmetric keys. Any other non-empty string is assumed to be an HMAC secret: ```js function performDetectPublicKeyAlgorithms(key) { const trimmedKey = key.trim() const publicKeyPemMatch = trimmedKey.match(publicKeyPemMatcher) if (trimmedKey.match(privateKeyPemMatcher)) { throw new TokenError( TokenError.codes.invalidKey, 'Private keys are not supported for verifying.' ) } else if ( publicKeyPemMatch && publicKeyPemMatch[1] === 'RSA' ) { return rsaAlgorithms } else if ( !publicKeyPemMatch && !trimmedKey.includes(publicKeyX509CertMatcher) ) { // Not a PEM, assume a pl",
    "evidence": "osv:GHSA-g3jj-5cmm-3hxx",
    "products": [
      {
        "name": {
          "value": "fast-jwt",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.3.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "6.2.4",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-g3jj-5cmm-3hxx",
      "aliases": [
        "CVE-2026-107724",
        "GHSA-g3jj-5cmm-3hxx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "6.2.4"
                },
                {
                  "fixed": "6.3.0"
                }
              ]
            }
          ],
          "package": {
            "name": "fast-jwt",
            "purl": "pkg:npm/fast-jwt",
            "ecosystem": "npm"
          },
          "versions": [
            "6.2.4"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g3jj-5cmm-3hxx/GHSA-g3jj-5cmm-3hxx.json"
          }
        }
      ],
      "modified": "2026-10-08T22:15:05.443432335Z",
      "provider": "osv",
      "references": [
        "https://github.com/nearform/fast-jwt/security/advisories/GHSA-g3jj-5cmm-3hxx",
        "https://github.com/nearform/fast-jwt/pull/636",
        "https://github.com/nearform/fast-jwt/commit/10f9591349199ed2ab9fa1748ce92cdca697f6cf",
        "https://github.com/nearform/fast-jwt",
        "https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-347"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-08T22:01:53Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107724",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 104805,
  "published_at": "2026-10-08T22:01:53+00:00"
}