CVE-2026-107721 Details
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in version 6.3.0.
A vulnerability in fast-jwt versions through 6.2.4 allows the 'clockTolerance' option to be set to Infinity, which bypasses important validation checks for JSON Web Tokens (JWTs). This misconfiguration can lead to the acceptance of expired or not-yet-active tokens. The issue arises because the option validation only checks for type and negativity, not finiteness. Additionally, the verifier's cache can inherit this infinite validity, causing tokens to remain accepted until evicted from the cache. Exploitation requires an application administrator or equivalent configuration path to set 'clockTolerance' to Infinity.
Users should update to fast-jwt version 6.3.0 or later, where this vulnerability has been fixed. The update corrects the option validation to reject non-finite values like Infinity, ensuring that 'clockTolerance' and related options are properly validated before being applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nearform/fast-jwt/commit/c0fb5b88b4c88ff2bdd194ca2c713599ad9e38b6 | [email protected] | Source CodeVendor |
| https://github.com/nearform/fast-jwt/releases/tag/v6.3.0 | [email protected] | Release NotesVendor |
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-687g-22h4-j4w4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
| CWE-682 | Incorrect Calculation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fast-jwt | <= 6.2.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |