Authentication bypass in fast-jwt via empty async HMAC secret (CVE-2026-44351)

A critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When an async key resolver returns an empty string (`''`) or zero-length `Buffer`, fast-jwt derives an HMAC algorithm family from the empty key and verifies the token signature against an empty-key HMAC, which Node.js accepts without error. An attacker can exploit this to mint JWTs with arbitrary claims (sub, admin, roles, scopes, etc.), achieving full identity assumption against any application that trusts JWT claims for authorisation. Affected versions: - <= 6.2.3 We recommend updating to: 6.2.4. CVSS 9.1 · our assessment: act_now Reference: https://github.com/nearform/fast-jwt/security/advisories/GHSA-gmvf-9v4p-v8jc Details: https://vuln.today/cve/CVE-2026-44351