Skip to content
Threat Feed

Tag

Fast-Jwt

1 brief RSS
critical advisory

fast-jwt Library JWT Algorithm Confusion Vulnerability

The fast-jwt library is vulnerable to JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key due to an incomplete fix for CVE-2023-48223, allowing attackers to bypass intended security measures by exploiting leading whitespace in the RSA public key, enabling attackers to sign arbitrary payloads that will be accepted by the verifier, potentially leading to privilege escalation.

jwt algorithm-confusion vulnerability fast-jwt nodejs
2r 1t 1c