{"action":"Upgrade fast-jwt to 6.3.0 or later.","affected":[{"fixed":"6.3.0","introduced":"6.2.0"}],"component":"fast-jwt","cve_ids":["CVE-2026-107722"],"ecosystem":"npm","epss":0.00356,"exploited":false,"fixed_versions":["6.3.0"],"ghsa_id":"GHSA-ww5h-9m49-7xx4","id":"tcs_01M5KGG4PG703E7QVHG84DM8JY","modified_at":"2026-10-08T22:15:05.895384054Z","published_at":"2026-10-08T22:02:07Z","references":["https://osv.dev/vulnerability/GHSA-ww5h-9m49-7xx4","https://github.com/nearform/fast-jwt/security/advisories/GHSA-ww5h-9m49-7xx4","https://github.com/nearform/fast-jwt/pull/632","https://github.com/nearform/fast-jwt/commit/d96bbc6c5336055a6dbfa318fdbab01197264cfa","https://github.com/nearform/fast-jwt","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-ww5h-9m49-7xx4","url":"https://osv.dev/vulnerability/GHSA-ww5h-9m49-7xx4"}],"summary":"fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion"}