The fast-jwt library provides a fast JSON Web Token implementation. In versions 6.1.0 and earlier, the regex used to match public keys (publicKeyPemMatcher in fast-jwt/src/crypto.js) relies on a ^ anchor that fails to account for leading whitespace in the key string. This weakness defeats the regex's intended validation, effectively re-enabling the JWT algorithm confusion attack that was previously addressed in CVE-2023-48223. The vulnerability is classified under CWE-327, indicating the use of a broken or risky cryptographic algorithm. The CVSS v3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

Successful exploitation of this vulnerability could allow attackers to bypass JWT signature verification by exploiting algorithm confusion, leading to unauthorized access or privilege escalation in systems relying on fast-jwt for authentication. The impact includes full compromise of confidentiality and integrity of JWT-based authentication tokens. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor nearform's official channels for updates. As a temporary measure, avoid using affected versions (<= 6.1.0) of fast-jwt in production environments or implement additional validation layers for JWT processing to mitigate algorithm confusion risks.