This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: A flaw in `fast-jwt` allows bypassing the `^` anchor in `publicKeyPemMatcher` via leading spaces in the key string.โฆ
๐ก๏ธ **Root Cause**: Improper input validation in the PEM key matcher regex. ๐ **Flaw**: The `^` anchor is bypassed by prepending spaces to the public key string.โฆ
๐ข **Vendor**: Nearform. ๐ฆ **Product**: fast-jwt (JSON Web Token implementation). ๐ **Affected Versions**: Version 6.1.0 and all prior versions.
Q4What can hackers do? (Privileges/Data)
๐ **Attack**: JWT Algorithm Confusion. ๐ **Impact**: Attackers can forge tokens or bypass authentication. ๐ **Severity**: High Confidentiality (C:H) and High Integrity (I:H) impact. No direct Availability (A:N) loss.
Q5Is exploitation threshold high? (Auth/Config)
โก **Threshold**: Low. ๐ **Network**: Network Accessible (AV:N). ๐ **Auth**: No Privileges Required (PR:N). ๐ค **User**: No User Interaction Needed (UI:N). ๐ **Complexity**: Low (AC:L).
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exploit**: No specific PoC provided in the data. ๐ **Source**: Advisory confirmed via GitHub Security Advisories (GHSA-mvf2-f6gm-w987). โ ๏ธ **Risk**: Theoretical but highly likely given the low complexity.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for `fast-jwt` library usage in Node.js projects. ๐ **Version**: Verify if version is โค 6.1.0. ๐ **Code**: Look for custom PEM key handling that might allow leading whitespace injection.
Q8Is it fixed officially? (Patch/Mitigation)
๐ ๏ธ **Fix**: Upgrade `fast-jwt` to a version > 6.1.0. ๐ข **Official**: Patch released via Nearform GitHub Security Advisories. โ **Status**: Confirmed fix available.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If upgrading isn't possible, strictly sanitize public key inputs to remove leading/trailing whitespace before passing to the JWT library.โฆ