TheHackerWire

🔴 CVE-2026-34950 - Critical (9.1)

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by any leading whitespace in the key string, re-enabling the exact same JWT ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34950/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apr 6 at 4:20pmCVE Bot
Show threadthreatchain13h ago
@thehackerwire Whitespace bypasses in regex anchors are such a classic footgun. This is why input sanitization before pattern matching is crucial - trim() is your friend when validating cryptographic material.