fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.
The regular expression `publicKeyPemMatcher` in the `fast-jwt/src/crypto.js` file uses the `^` anchor, which stops working properly when the public key string is preceded by whitespace characters (e.g., space or newline). An attacker can supply a public key with preceding whitespace, causing the regex to fail to recognize it as a PEM key. As a result, the library incorrectly interprets the JWT token signature algorithm, enabling an algorithm confusion attack — that is, substituting the public key as a symmetric HMAC secret to forge the token signature.
An attacker can forge a JWT token without knowledge of the server's private key, gaining unauthorized access to authentication-protected resources and potentially modifying token content (e.g., permissions or user identity).
Apply patches available from the vendor according to the references (GHSA-mvf2-f6gm-w987 advisory on GitHub). It is recommended to update the fast-jwt library to a version higher than 6.1.0 as soon as it becomes available from the vendor.
Nearform fast-jwt version 6.1.0 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NNearform Fast Jwt
APPNearform< 6.2.0
Related vulnerabilities
Kolizja cache w fast-jwt prowadząca do błędnej identyfikacji użytkowników
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate t...
fast-jwt dostarcza szybką implementację JSON Web Token (JWT). Przed wersją 6.2.1 użycie określonych modyfikato...
fast-jwt to biblioteka zapewniająca szybką implementację JSON Web Token (JWT). W wersjach od 5.0.0 do 6.2.0 is...
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does ...