CVE-2026-107723: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
fast-jwt’s createVerifier silently skips all configured claim validators (exp, nbf, iss, aud, sub, jti, nonce) when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library’s documented allowedIss / allowedAud / allowedSub / expiry / replay-protection guarantees and violates RFC 7519 §7.2 step 10, which requires the JWT Claims Set to be a JSON object.
References
- github.com/advisories/GHSA-5hjw-83fp-phq9
- github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368
- github.com/nearform/fast-jwt/pull/639
- github.com/nearform/fast-jwt/releases/tag/v6.3.0
- github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9
- nvd.nist.gov/vuln/detail/CVE-2026-107723
Code Behaviors & Features
Detect and mitigate CVE-2026-107723 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →