JWT Token Expiration Bypass in Fastify JWT Plugin

Executive Summary

The @fastify/jwt plugin for Fastify, versions before 10.2.5, has a flaw where top-level sign and verify methods replace global default settings instead of merging them with per-call options. This causes tokens to lack expiration claims or maxAge enforcement, allowing indefinitely valid or expired tokens to be accepted.

Useful 0 Not Useful 0

Detection Guidance

Check the version of @fastify/jwt in your project using npm list @fastify/jwt or grep the package.json file. If the version is below 10.2.5, the system is vulnerable. Review code using top-level fastify.jwt.sign() or fastify.jwt.verify() methods outside route handlers to confirm if global defaults like expiresIn or maxAge are set.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected top-level APIs (fastify.jwt.sign or fastify.jwt.verify) with global temporal protections like expiresIn or maxAge, tokens may become valid indefinitely or expired tokens may be accepted. This could lead to unauthorized access or data breaches if stale tokens are used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate token expiration and access controls, such as GDPR's data retention principles or HIPAA's access authorization rules. Accepting stale or indefinite tokens may lead to unauthorized data access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @fastify/jwt to version 10.2.5 or later immediately. If immediate upgrade is not possible, restate global defaults in per-call options or switch to using reply.jwtSign and request.jwtVerify route decorators which are not affected.

Useful 0 Not Useful 0