CVE-2026-34950

OVERVIEW CVE-2026-34950 affects fast-jwt, a JSON Web Token implementation library, in versions 6.1.0 and earlier. The vulnerability stems from a flawed regex pattern in the publicKeyPemMatcher function that fails to properly validate public key formats when leading whitespace is present. This design flaw reintroduces a JWT algorithm confusion attack that was previously patched in CVE-2023-48223, allowing attackers to bypass cryptographic validation controls. SEVERITY This vulnerability carries a CVSS score of 9.1 (CRITICAL) with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity, making it easily exploitable across all systems using the affected library. Successful exploitation enables attackers to read sensitive data and modify information, though system availability is not directly impacted. The high confidentiality and integrity impact scores reflect the serious nature of JWT algorithm confusion attacks, which can lead to unauthorized access and data manipulation. EXPLOITATION STATUS There is currently no indication of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog. Exploit code availability is not documented, and community attention remains minimal with the Hot List status marked as inactive. However, organizations should prioritize patching given the high CVSS score and the technical simplicity of exploiting this weakness once it becomes public.