fast-jwt: Claim validator bypass via JSON array payload
Summary
The fast-jwt library for Node.js accepts a validly signed JWT whose payload is a JSON array. In that case, configured checks for exp, nbf, iss, aud, sub, jti and nonce are silently skipped, and the token is returned as verified. An attacker who can produce or influence a validly signed token can bypass expiry, issuer, audience, subject, revocation and replay protections. Signature verification itself is not bypassed.
Affected
- fast-jwt versions before 6.3.0 (the GitHub advisory lists <= 6.2.4)
- Applications that use fast-jwt directly or through dependencies such as @fastify/jwt
Fixed in
- Fixed in fast-jwt 6.3.0 (array payloads are rejected by the decoder)
- Related advisories are fixed in 6.3.1 and 6.3.4; use the newest release
Workaround
- Set the requiredClaims option so that missing claims are rejected. This is a partial measure only and does not fix the parsing issue.
- Upgrading is the actual fix.
Exploitation
- Public proof of concept: yes, included in the GitHub advisory
- Exploited in the wild: no evidence found (CISA KEV not checked)
- CISA SSVC: exploitation PoC, not automatable, total technical impact
- EPSS is low (0.00358)
Our recommendation
- Check lock files and dependency trees for fast-jwt, including transitive dependencies.
- Upgrade to the latest fast-jwt release (at least 6.3.4).
- Review applications that accept tokens from several issuers, partners or user-controlled signing paths first, especially if they are internet-facing.
- Set requiredClaims as an interim measure where upgrading is delayed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5hjw-83fp-phq9 github.com
- fast-jwt release v6.3.0 github.com
- Fix commit 86e83ef github.com
- Fix pull request #639 github.com
- OSV: CVE-2026-107723 osv.dev
- fast-jwt releases github.com
- GitLab Advisory: CVE-2026-107723 advisories.gitlab.com
- Vulners: CVE-2026-107723 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:30.
Original description (NVD)
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.
NVD references (5)
- https://github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368
- https://github.com/nearform/fast-jwt/pull/639
- https://github.com/nearform/fast-jwt/releases/tag/v6.3.0
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.