CVE-2026-44351: Authentication Bypass in fast-jwt

The impact of CVE-2026-44351 is severe. An attacker can exploit this vulnerability to impersonate legitimate users, access sensitive data, and potentially compromise the entire application. The vulnerability stems from how fast-jwt handles empty key resolver responses. Specifically, if the key resolver returns an empty string, fast-jwt incorrectly derives allowed algorithms, enabling signature verification against an empty key. This allows an attacker to craft a JWT with a valid signature (even a trivial one) that will be accepted as authentic. This is similar to vulnerabilities where improper key handling leads to authentication bypass, potentially granting full control over the application’s functionality.

1. Reservado2026-05-05
2. Publicada2026-05-13

The primary mitigation for CVE-2026-44351 is to upgrade to fast-jwt version 6.2.4 or later. This version includes a fix that prevents the incorrect key derivation. If upgrading immediately is not feasible, consider implementing a temporary workaround by ensuring that your key resolver never returns an empty string. This can be achieved by adding a default key or error handling to prevent an empty response. Additionally, implement strict input validation on JWTs to prevent unexpected data from being processed. After upgrading, verify the fix by attempting to forge a JWT with an empty key and confirming that it is rejected.