CVE-2026-107719 Details
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.
A vulnerability in fast-jwt, a library for handling JSON Web Tokens (JWTs), allows expired tokens to be accepted under certain conditions. This issue exists in versions through 6.3.3. The problem arises because the library's caching mechanism incorrectly handles the expiration of tokens that do not include an 'issued at' (iat) claim. When caching is enabled, the verifier can mistakenly accept a token after its expiration time, potentially extending access rights until the cache entry expires. This flaw does not allow an attacker to forge a token, but it can be exploited to misuse a valid token that has expired.
Users can upgrade to fast-jwt version 6.3.4, which fixes the vulnerability by ensuring that the cache expiration is correctly derived from the 'exp' claim, regardless of the 'iat' claim.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-x937-hj6v-793p | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/nearform/fast-jwt/commit/fc1ddbbe5ce38066ba2cea0b0ce0233932757167 | [email protected] | Source CodeVendor |
| https://github.com/nearform/fast-jwt/releases/tag/v6.3.4 | [email protected] | Release NotesVendor |
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-x937-hj6v-793p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fast-jwt | <= 6.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |