{"answers":{"affected":"2 open source packages ship an affected version, including fast-jwt.","exploited":"There is no known exploitation of CVE-2026-44351 in the wild and no public exploit code.","fix":"Upgrade fast-jwt to 6.2.4 or later.","what":"CVE-2026-44351 is a critical authentication bypass vulnerability in nearform fast-jwt, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-44351 and fix it if it is affected.\n\nWhat it is: CVE-2026-44351 is a critical authentication bypass vulnerability in nearform fast-jwt, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-44351 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fast-jwt (npm): affected all versions; fixed in 6.2.4\n- fast-jwt (npm): affected all versions; fixed in 6.2.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-44351/ (Markdown: https://insights.sbomify.com/CVE-2026-44351/index.md)","id":"CVE-2026-44351","markdown":"https://insights.sbomify.com/CVE-2026-44351/index.md","name":"CVE-2026-44351","record":{"aliases":["GHSA-gmvf-9v4p-v8jc"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js JWT library","requires_auth":"none","summary":"Attackers can forge valid JWTs by exploiting empty HMAC secret handling in async key resolvers, bypassing authentication and gaining unauthorized access.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-326","name":"Inadequate Encryption Strength"},{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-1391","name":"Use of Weak Credentials"}],"description":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":"2026-09-15","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-09-15T00:58:36Z","kind":"github_poc","ref":"https://github.com/isaca0315/CVE-2026-44351-poc","stars":0,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass","id":"CVE-2026-44351","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Flowsint: Broken Access Control allows reading of sketch logs from any user","id":"CVE-2026-44352"},"packages":[{"ecosystem":"npm","fixed":["6.2.4"],"introduced":["0"],"last_affected":[],"package":"fast-jwt","purl":null,"source":"GHSA-gmvf-9v4p-v8jc"},{"ecosystem":"npm","fixed":["6.2.4"],"introduced":["0"],"last_affected":[],"package":"fast-jwt","purl":"pkg:npm/fast-jwt","source":"GHSA-gmvf-9v4p-v8jc"}],"prev":{"headline":"Daptin fuzzy search injects unvalidated column name into raw SQL","id":"CVE-2026-44349"},"products":["fast-jwt"],"published":"2026-05-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-05-14","vendors":["nearform"]},"summary":"Attackers can forge valid JWTs by exploiting empty HMAC secret handling in async key resolvers, bypassing authentication and gaining unauthorized access.","url":"https://insights.sbomify.com/CVE-2026-44351/"}