Key points
- CVE-2026-107723 affects fast-jwt versions prior to 6.3.0
- Attackers can bypass exp, iss, aud, sub, and nonce validations using array payloads
- Version 6.3.0 has been released to resolve the vulnerability
The nearform fast-jwt library contains a high-severity vulnerability, tracked as CVE-2026-107723, that allows attackers to bypass critical JSON Web Token (JWT) claim validations. The issue stems from inadequate input handling in the `createVerifier` function, which fails to reject JSON arrays presented as token payloads.
According to the NVD record, the flaw enables an attacker who can produce or influence a validly signed token to circumvent protections for expiry, issuer, audience, subject, revocation, and replay. While the cryptographic signature verification remains intact, the library’s logic for validating specific claims is effectively neutralised when the payload is structured as an array rather than an object. This results in the verifier returning the array as a successfully verified payload, despite the absence of required security assertions.
Technical context and background
The vulnerability arises from a discrepancy in how the library decodes and validates different parts of the JWT. As detailed in the GitHub advisory GHSA-5hjw-83fp-phq9, the decoder correctly validates that the header is a non-array object. However, the check for the payload relies on a `typeof` comparison that does not account for JavaScript’s treatment of arrays as objects.
Specifically, the code in `src/decoder.js` checks if the payload is an object but lacks an `Array.isArray` guard. Because `typeof []` evaluates to `'object'` in JavaScript, an array payload passes this initial validation. Subsequently, the verifier’s validator loop iterates through configured checks for claims such as `exp`, `nbf`, `iss`, `aud`, `sub`, `jti`, and `nonce`. These checks use an `in` test to determine if the claim exists in the payload. Since arrays only possess numeric indices and a length property, tests for named claims always return false. Consequently, every validator is silently skipped, and no error is returned to the caller.
This behaviour violates RFC 7519 hqz-7.2 step 10, which mandates that the JWT Claims Set must be a JSON object. The advisory notes that while the opt-in `requiredClaims` option can block missing claims by throwing an error, the standard validation mechanisms for `allowedIss`, `allowedAud`, `allowedSub`, expiry, and replay protection are broken.
Who is affected
The vulnerability affects all versions of the npm package `fast-jwt` prior to 6.3.0. According to the GitHub advisory, versions up to and including 6.2.4 are vulnerable. The issue has been resolved in version 6.3.0. Organisations using `fast-jwt` in their authentication or authorisation flows should verify their current version and upgrade immediately to mitigate the risk of token validation bypass.
Our take on the response
The release of version 6.3.0 provides a direct fix for CVE-2026-107723. Security teams should prioritise updating the library across their environments. Given that the vulnerability allows for the bypass of fundamental JWT security properties, such as expiry and issuer validation, the risk of successful exploitation is significant for any application relying on these checks for access control.
What to do and how to stay safe: fast-jwt
- Audit your dependency tree to identify any usage of `fast-jwt` versions below 6.3.0.
- Upgrade the `fast-jwt` package to version 6.3.0 or later as soon as possible.
- Review logs for any anomalous token verification successes that may indicate exploitation attempts.
- Implement additional server-side validation for critical claims if relying solely on library defaults is insufficient.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107723?
It is a high-severity vulnerability in fast-jwt that allows attackers to bypass claim validation by submitting a JWT with a JSON array payload.
Which versions of fast-jwt are vulnerable?
All versions prior to 6.3.0 are affected, including version 6.2.4 and earlier.
Does this vulnerability bypass signature verification?
No, the signature verification itself is not bypassed, but claim checks such as expiry and issuer are skipped.