CVE-2026-44351: Authentication Bypass in fast-jwt

The impact of this vulnerability is severe. An attacker can exploit it to gain unauthorized access to systems and data protected by JWT authentication. By forging valid JWTs, they can impersonate legitimate users and perform actions as if they were authorized. This could lead to data breaches, privilege escalation, and complete compromise of the affected application. The ability to bypass authentication entirely represents a significant security risk, particularly in applications relying heavily on JWTs for access control. The zero-length buffer derivation for allowed algorithms is a particularly concerning aspect, as it allows attackers to bypass signature verification entirely.

1. Reserviert2026-05-05
2. Veröffentlicht2026-05-13

The primary mitigation is to immediately upgrade to fast-jwt version 6.2.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to ensure that your key resolver never returns an empty string. Strictly validate the output of your key resolver to prevent empty strings from being passed to fast-jwt. Additionally, consider implementing stricter JWT validation rules, such as verifying the issuer and audience claims, to limit the potential damage from forged tokens. After upgrading, confirm the fix by attempting to forge a JWT with a missing or invalid key identifier and verifying that it is rejected.