Two npm flaws: fast-jwt key confusion and decompress symlink traversal

fast-jwt 6.2.0–6.3.0 carries CVE-2026-107722 (CVSS 9.8): an RSA public key with leading noise is treated as an HMAC secret, allowing JWT forgery; it is fixed in 6.3.0. The decompress package has CVE-2026-101894 (CVSS 9.1), a symlink path traversal; the original 4.2.1 is unmaintained, while fork @xhmikosr/decompress is fixed in 10.2.2 and 11.1.4.

• fast-jwt 6.2.0–6.3.0: CVSS 9.8, fixed in 6.3.0
• decompress: CVSS 9.1, original 4.2.1 gets no patch
• Fork @xhmikosr/decompress fixed in 10.2.2 and 11.1.4
• Node.js runtime upgrades do not change dependency versions