Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y4fp-mm35-xbhj
Vulnerability ID VCID-y4fp-mm35-xbhj
Aliases CVE-2026-34950
GHSA-mvf2-f6gm-w987
Summary fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00025 https://api.first.org/data/v1/epss?cve=CVE-2026-34950
cvssv3.1 9.1 https://github.com/advisories/GHSA-c2ff-88x2-x9pg
generic_textual CRITICAL https://github.com/advisories/GHSA-c2ff-88x2-x9pg
cvssv3.1 9.1 https://github.com/nearform/fast-jwt
generic_textual CRITICAL https://github.com/nearform/fast-jwt
cvssv3.1 9.1 https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
generic_textual CRITICAL https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
ssvc Track* https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2026-34950
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-34950
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-34950
https://github.com/advisories/GHSA-c2ff-88x2-x9pg
https://github.com/nearform/fast-jwt
https://nvd.nist.gov/vuln/detail/CVE-2026-34950
GHSA-mvf2-f6gm-w987 https://github.com/advisories/GHSA-mvf2-f6gm-w987
GHSA-mvf2-f6gm-w987 https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/advisories/GHSA-c2ff-88x2-x9pg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/nearform/fast-jwt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-04-06T18:43:07Z/ Found at https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34950
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07507
EPSS Score 0.00025
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:47:30.621370+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34950.json 38.6.0