{"id":"CVE-2026-107723","published":"2026-10-08T22:17:28.623","lastModified":"2026-10-14T02:16:57.877","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-1287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368","tags":[]},{"url":"https://github.com/nearform/fast-jwt/pull/639","tags":[]},{"url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.0","tags":[]},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9","tags":[]},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9","tags":[]}],"exploitRefs":[{"url":"https://github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368","tags":[]},{"url":"https://github.com/nearform/fast-jwt/pull/639","tags":[]},{"url":"https://github.com/nearform/fast-jwt/releases/tag/v6.3.0","tags":[]},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9","tags":[]},{"url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9","tags":[]}],"hasPoc":true,"ai":{"summary":"The fast-jwt library incorrectly accepts JWT payloads that are JSON arrays instead of objects, allowing attackers to bypass critical security checks like expiration, issuer, and audience validation. This occurs because the verifier doesn't reject array payloads, leading to silently skipped claim validations.","exploitability":"Exploitation requires an attacker who can generate or influence a validly signed JWT with an array payload, which is moderately difficult but possible in systems that accept user-provided tokens, with preconditions including the ability to craft valid signatures and control token payloads.","blast_radius":"The impact could be significant across applications using fast-jwt for authentication, potentially allowing unauthorized access to protected resources by bypassing essential JWT security controls.","remediation":"Upgrade to version 6.3.0 or later to fix the JWT payload validation issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["jwt","auth-bypass","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:19:18.957Z"}}