CVE-2026-107720: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
createVerifier in fast-jwt ≤ 6.3.0 skips signature verification entirely when the key option is a falsy synchronous value ('' or null) and the algorithms option is set to a non-empty allowlist. An attacker who can present a JWT to the application — regardless of algorithm — can forge arbitrary claims without possessing any signing key.
References
- github.com/advisories/GHSA-8wpc-h4q6-8fxv
- github.com/nearform/fast-jwt/commit/e22a151e83bf6d5e54e281216982d204d5665534
- github.com/nearform/fast-jwt/pull/649
- github.com/nearform/fast-jwt/releases/tag/v6.3.1
- github.com/nearform/fast-jwt/security/advisories/GHSA-8wpc-h4q6-8fxv
- nvd.nist.gov/vuln/detail/CVE-2026-107720
Code Behaviors & Features
Detect and mitigate CVE-2026-107720 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →