fast-jwt EUVD-2026-95312

Exploitable only when the application passes a raw serialized public JWK or JWKS JSON string (not a PEM-encoded key or X.509 cert) as the verifier key to fast-jwt 6.2.4, AND HS256 (or another HS* algorithm) is explicitly in the allowlist or inferred via automatic detection. The attacker must reproduce the victim's exact serialized JSON bytes - differing property ordering or whitespace defeats the HMAC key match. Limiting factors: applications using PEM-format keys with an asymmetric-only (RS*/ES*/EdDSA) algorithm allowlist are not affected, and symmetric kty=oct JWKs are legitimately out of scope. No user interaction or authentication is required once the vulnerable configuration exists.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 High) accurately captures a network-reachable, unauthenticated signature-verification bypass (CWE-347) with high confidentiality and integrity impact but meaningful attack complexity. The AC:H rating is well justified: exploitation only works when the application feeds fast-jwt a raw serialized public JWK/JWKS JSON string as the verifier key AND HS256 is allowed/inferred, and the attacker's forged key bytes must byte-for-byte match the victim's serialization (ordering and whitespace), which the advisory explicitly notes can prevent exploitation. No EPSS score, KEV listing, or SSVC decision data was provided, so automatable/widespread-exploitation signals cannot be assessed - treat the absence of EPSS/KEV as missing data, not as evidence of low risk. A PoC is documented in the GHSA advisory (publicly available exploit code exists), which raises practical risk, but the required non-default key-handling pattern makes this a targeted/configuration-dependent issue rather than a broadly sprayable one. Net: a real priority for teams that pass JWK/JWKS JSON directly to fast-jwt with a symmetric algorithm in the allowlist; low real-world exposure for the common case of PEM keys with an asymmetric-only allowlist, who the advisory states are not affected.

An application configures fast-jwt (<=6.2.4) to verify tokens using a raw serialized public JWK or JWKS JSON string as the key, with HS256 explicitly allowed or auto-inferred. Because the public JWK material is public by design, a remote unauthenticated attacker who reproduces the exact serialized JSON bytes uses them as an HMAC secret to sign a forged HS256 token with arbitrary claims, which createVerifier accepts - yielding authentication/authorization bypass. A proof-of-concept using a serialized RSA public JWK is published in the GHSA advisory.