fast-jwt vulnerability allows attackers to bypass JWT claim validation checks

The nearform fast-jwt library contains a high-severity vulnerability that allows attackers to bypass critical JSON Web Token (JWT) security checks. The flaw, tracked as CVE-2026-107723, affects versions prior to 6.3.0 and has been assigned a CVSS score of 8.1.

The vulnerability exists because the library’s decoder accepts JSON arrays as valid payloads, even though the JWT specification requires claims sets to be JSON objects. When an attacker presents a validly signed token with an array payload, the verifier silently skips all configured claim validators. This includes checks for expiration, issuer, audience, subject, and replay protection. The library returns the array as a successfully verified payload, effectively neutralizing these security controls.

Technical Context

According to the National Vulnerability Database, the issue stems from inadequate input validation in the `src/decoder.js` file. The code checks that the payload is an object but fails to explicitly reject arrays. In JavaScript, the `typeof` operator returns "object" for arrays, allowing them to pass the initial validation step.

The GitHub security advisory for GHSA-5hjw-83fp-phq9 explains that the verifier’s claim validation loop relies on the `in` operator to check for specific claim names like `exp`, `nbf`, `iss`, `aud`, `sub`, `jti`, and `nonce`. Because arrays only have numeric indices and a length property, these named properties are never found. Consequently, the loop continues without executing any validation logic for these claims.

This behavior violates RFC 7519 Section 7.2, which mandates that the JWT Claims Set must be a JSON object. While signature verification remains intact and is not bypassed, the loss of claim validation undermines the token’s integrity guarantees. The advisory notes that the optional `requiredClaims` configuration can block missing claims, but this does not mitigate the core issue of skipped validators for standard claims.

Who Is Affected

The vulnerability affects all applications using the `fast-jwt` npm package in versions 6.2.4 and earlier. Developers who rely on the library’s default behavior for enforcing token expiration, issuer trust, or audience restrictions are exposed to potential exploitation.

An attacker who can produce or influence a validly signed token can exploit this flaw. By crafting a token with an array payload, they can bypass expiry, issuer, audience, subject, revocation, and replay protections. This allows for the use of expired tokens or tokens issued by unauthorized parties, provided the cryptographic signature is valid.

What should you do?

The vendor has released version 6.3.0, which fixes the vulnerability by adding the necessary guard to reject array payloads. Users should update their dependencies to this patched version immediately.