theinfosecnews
theinfosecnews
Subscribe to Daily Digest

CVE-2026-34950

Published April 6, 2026 · Updated April 6, 2026

9.1CVSS
critical

What This Means

CVE-2026-34950 is a critical vulnerability with a CVSS score of 9.1 in the fast-jwt library, affecting versions 6.1.0 and earlier. The issue arises from a regex flaw that allows leading whitespace in the public key string, potentially enabling a JWT algorithm confusion attack similar to CVE-2023-48223. Security teams should update to the latest version of fast-jwt to mitigate this vulnerability.

Official Description+

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT algorithm confusion attack that CVE-2023-48223 patched.

Recommended Actions

  1. Check if your systems use any of the affected products listed above.
  2. Apply vendor patches immediately if available.
  3. Monitor vendor advisories for updates and additional mitigations.
  4. Review logs for indicators of compromise related to CVE-2026-34950.

Related Coverage