fast-jwt CVE-2026-107723 Bypasses Claim Checks via Array Payloads
A high-severity flaw in the popular Node.js library allows attackers to skip expiry, issuer, and audience validation by submitting tokens with array payloads.
Key points
- CVE-2026-107723 affects fast-jwt versions prior to 6.3.0
- The bug stems from JavaScript treating arrays as objects
- Signature verification remains intact, but claim checks are skipped
The nearform-maintained fast-jwt library contains a high-severity vulnerability that permits attackers to bypass standard JSON Web Token (JWT) claim validations. The flaw, tracked as CVE-2026-107723, allows an attacker with a validly signed token to evade expiry, issuer, audience, subject, revocation, and replay protections. The issue is rated 8.1 on the CVSS scale.
Root cause
The vulnerability exists in the decoder logic of fast-jwt versions older than 6.3.0. The library correctly validates that the JWT header is a non-array object. However, the payload validation check uses a `typeof` test that returns true for both objects and arrays in JavaScript. Consequently, a JWT payload containing a JSON array passes the initial structural check without error.
Attack path
When the verifier processes the token, it iterates through configured claim validators such as `exp`, `iss`, `aud`, `sub`, `jti`, and `nonce`. These checks rely on the `in` operator to determine if a named property exists in the payload. Because arrays possess only numeric indices, named properties like "exp" are absent. The verifier interprets this absence as a missing claim and silently skips the validation step for each property. The result is a successful verification of the signature while all security constraints are ignored. The library returns the array as a verified payload, violating RFC 7519 Section 7.2, which mandates that the Claims Set be a JSON object.
Affected versions
- npm package fast-jwt versions up to and including 6.2.4 are vulnerable
- The fix is available in version 6.3.0
Mitigation
- Upgrade fast-jwt to version 6.3.0 or later immediately
- Review application logs for tokens with array payloads, which may indicate exploitation
- Note that the optional `requiredClaims` configuration may block some attacks by throwing errors for missing claims, but it does not address the core validation skip for other checks
What to do and how to stay safe: fast-jwt
- Audit your Node.js dependencies to identify any usage of fast-jwt versions below 6.3.0
- Monitor application logs for unusual token payloads that contain arrays rather than JSON objects
- Ensure your deployment pipelines prevent the installation of vulnerable package versions
- Once the vendor provides an update, verify that new tokens adhere to RFC 7519 object requirements
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability allow attackers to forge signatures?
No, signature verification is not bypassed; the attacker must possess a validly signed token to exploit this flaw.
Which specific validations are skipped by this bug?
The verifier skips checks for expiry, issuer, audience, subject, JWT ID, and nonce when an array payload is present.
Is there a fix available for CVE-2026-107723?
Yes, the issue is resolved in fast-jwt version 6.3.0.
