Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Fix availableCritical · CVSS 9.8EPSS 0.27%

Published Oct 8, 2026 · updated Oct 8, 2026

What to do

  1. Upgrade to a fixed version: fast-jwt 6.3.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmfast-jwt

Vulnerable versions
>= 6.2.0, <= 6.2.4
Fixed in
6.3.0

Check your project: npm ls fast-jwt --all

Is fast-jwt@6.3.0 safe to install? See the upgrade verdict →

Sources

CWE-347 Improper Verification of Cryptographic Signature

← All critical vulnerabilities