CVE-2026-107275
- Source
- https://cve.org/CVERecord?id=CVE-2026-107275
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107275.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107275
- Aliases
-
- GHSA-9x4w-r9p5-5h7m
- Published
- 2026-10-08T11:05:40Z
- Modified
- 2026-10-12T02:31:13Z
- Severity
-
- 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
- Details
-
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.
- Database specific
{ "cna_assigner": "openjs", "cwe_ids": [ "CWE-390", "CWE-613", "CWE-754" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107275.json" }- References