CVE-2026-107723

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107723
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107723.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107723
Aliases
Published
2026-10-08T21:51:22Z
Modified
2026-10-10T02:47:23Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
Details

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107723.json"
}
References

Affected packages

Git / github.com/nearform/fast-jwt

Affected ranges

Type
GIT
Repo
https://github.com/nearform/fast-jwt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
86e83efd8b5244f50859532d99244f0a9a9a4368
Fixed
b351e31a755cdce457e0d25ce22b139bbcf469da
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.3.0
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.7.2
v2.*
v2.0.0
v6.*
v6.1.0
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107723.json"