CVE-2026-107723

Deferred Deferred - Pending Action

Array Validation Bypass in fast-jwt

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107723

Affected Vendors & Products

Vendor	Product	Version / Range
nearform	fast-jwt	< 6.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

fast-jwt before version 6.3.0 has a vulnerability where createVerifier incorrectly accepts a validly signed JWT with a JSON array payload. The decoder checks if the payload is an object but fails to reject arrays, causing claim validators to skip checks for properties like expiry or issuer. This allows bypassing security protections if an attacker can produce or influence a signed token.

Impact Analysis

An attacker could bypass token validation checks such as expiry, issuer, audience, subject, and replay protections. This may allow unauthorized access to systems or data protected by fast-jwt tokens. The vulnerability requires the attacker to produce or influence a validly signed token.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, or other regulations by allowing unauthorized access to sensitive data. Bypassing token protections may lead to data breaches or unauthorized transactions, violating confidentiality and integrity requirements.

Mitigation Strategies

Upgrade fast-jwt to version 6.3.0 or later to address the vulnerability. Review tokens for arrays in payloads if using older versions. Ensure requiredClaims option is enabled to block missing claims.

Hi! I’m here to help you understand CVE-2026-107723. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70