{"action":"Upgrade fast-jwt to 6.2.0 or later.","affected":[{"fixed":"6.2.0","introduced":"0"}],"component":"fast-jwt","cve_ids":["CVE-2026-34950"],"ecosystem":"npm","epss":0.0025,"exploited":false,"fixed_versions":["6.2.0"],"ghsa_id":"GHSA-mvf2-f6gm-w987","id":"tcs_01M5KG1RPQ3N6AS4XAK3047N15","modified_at":"2026-04-07T17:34:20.291474Z","published_at":"2026-04-02T20:37:54Z","references":["https://osv.dev/vulnerability/GHSA-mvf2-f6gm-w987","https://github.com/nearform/fast-jwt/security/advisories/GHSA-mvf2-f6gm-w987","https://nvd.nist.gov/vuln/detail/CVE-2026-34950","https://github.com/advisories/GHSA-c2ff-88x2-x9pg","https://github.com/nearform/fast-jwt"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-mvf2-f6gm-w987","url":"https://osv.dev/vulnerability/GHSA-mvf2-f6gm-w987"}],"summary":"fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key"}