The fast-jwt fix for algorithm confusion missed the prefix

JWT libraries have been fighting the same class of bug for a decade: a verifier that is handed a public key and a token whose header says HS256, and which decides the key must therefore be an HMAC secret. CVE-2026-107722 is a later round of that fight, and what makes it worth reading is not the bypass itself but where the previous fix stopped.

What is affected

The CVE record covers the npm package fast-jwt , from version 6.2.0 until 6.3.0. The vulnerability is explicitly described as an incomplete patch of an earlier issue, CVE-2026-34950. Version 6.3.0 contains the current fix.

The record rates it 9.8 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H . The attack is network-reachable, needs no privileges and no user interaction, and affects confidentiality, integrity and availability.…