Authentication Bypass in Fast-JWT by NearForm

CVE-2026-44351

What is CVE-2026-44351?

Fast-jwt, a library providing a lightweight implementation of JSON Web Tokens (JWTs), has a vulnerability in its async key-resolver flow prior to version 6.2.4. This flaw allows unauthenticated attackers to forge arbitrary JWTs, which are then accepted as valid by the application. The issue arises when the key resolver returns an empty string, leading to the generation of a zero-length Buffer used in the HMAC signing process. An attacker is able to compute a signature that the application verifies successfully, thereby gaining illegitimate access by crafting a token with malicious payloads. Version 6.2.4 addresses this significant security concern.

References