Organisations urged to patch fast-jwt as CVE-2026-107723 enables token validation bypass via array payloads

Applications using the fast-jwt library for JSON Web Token verification are exposed to a high-severity vulnerability that allows attackers to bypass critical security checks. The flaw, tracked as CVE-2026-107723, enables an attacker to submit a token with a valid signature but an invalid payload structure, causing the library to skip verification of expiry, issuer, audience, and other claims.

How does the vulnerability work?

The issue stems from how the library validates the structure of a JWT payload. According to the National Vulnerability Database, the `createVerifier` function in versions prior to 6.3.0 accepts a payload that is a JSON array instead of a JSON object. In JavaScript, the `typeof` operator returns "object" for arrays, allowing the array to pass the initial type check in `src/decoder.js`.

Once the array passes decoding, the claim validator loop attempts to check for properties such as `exp`, `nbf`, `iss`, `aud`, `sub`, `jti`, and `nonce`. Because arrays in JavaScript use numeric indices rather than named properties, the `in` operator returns false for these claim names. Consequently, the loop silently skips all configured checks and returns the array as a successfully verified payload. This behavior violates RFC 7519 Section 7.2, which requires the JWT Claims Set to be a JSON object.

What is the impact on security controls?

An attacker who can produce or influence a validly signed token can bypass multiple layers of protection. The vulnerability allows the circumvention of expiry (`exp`), not-before (`nbf`), issuer (`iss`), audience (`aud`), subject (`sub`), JWT ID (`jti`), and nonce checks. According to the GitHub advisory, this breaks the library’s guarantees for `allowedIss`, `allowedAud`, and `allowedSub`, as well as replay protections.

Signature verification itself is not bypassed; the token must still be validly signed. However, the semantic security of the token is compromised because the application accepts the token as valid despite it lacking the required claims. The advisory notes that the opt-in `requiredClaims` option can block missing claims by throwing an error, but standard validators are silently skipped.

Which versions are affected and fixed?

The vulnerability affects the npm package `fast-jwt` in all versions up to and including 6.2.4. The vendor, nearform, has released version 6.3.0, which fixes the issue by adding an `Array.isArray` guard to the payload validation logic. This update ensures that payloads are strictly JSON objects, aligning with RFC 7519 requirements and preventing the silent skipping of claim validators.

What should developers do next?

Developers using fast-jwt should immediately audit their dependency trees to identify if they are running version 6.2.4 or earlier. If affected, they should upgrade to version 6.3.0 or later. Organizations should also review their token handling logic to ensure that payloads are validated for structure before processing, even if the library update is delayed. Monitoring logs for tokens with unexpected payload structures can help detect exploitation attempts.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: fast-jwt

• Update the fast-jwt package to version 6.3.0 or later to apply the official patch.
• Audit codebases to ensure JWT payloads are validated as objects before processing claims.
• Review application logs for tokens that were accepted with array payloads or missing claims.
• Implement additional server-side checks for critical claims like expiry and issuer, independent of the library.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability allow attackers to forge JWT signatures?

No, the signature verification process remains intact and is not bypassed by this flaw.

Which specific claims are bypassed by this vulnerability?

The bypass affects exp, nbf, iss, aud, sub, jti, and nonce claim validations.

Is there a workaround before updating the library?

The opt-in requiredClaims option can block missing claims, but it does not fix the underlying structure issue.