CVE-2026-107721: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

October 8, 2026

createVerifier({ clockTolerance: Infinity }) silently bypasses both exp (expiry) AND nbf (not-before) validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier’s internal cache so cached entries inherit infinite validity — they remain valid past a later developer-removed Infinity config until LRU eviction.

References

github.com/advisories/GHSA-687g-22h4-j4w4
github.com/nearform/fast-jwt/commit/c0fb5b88b4c88ff2bdd194ca2c713599ad9e38b6
github.com/nearform/fast-jwt/releases/tag/v6.3.0
github.com/nearform/fast-jwt/security/advisories/GHSA-687g-22h4-j4w4
nvd.nist.gov/vuln/detail/CVE-2026-107721

Code Behaviors & Features

Detect and mitigate CVE-2026-107721 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →