CVE-2026-107719: fast-jwt expiration bypass in token caching

CVE-2026-107719 · Severity: medium · CVSS 4.2 · Published 2026-10-08

fast-jwt is a library for signing and verifying JSON Web Tokens (JWTs), commonly used to authenticate API requests and manage user sessions. When caching is enabled, the library incorrectly handles expiration checks for tokens that have an expiration time but lack an "issued at" claim, allowing an attacker who possesses a valid token to continue using it after expiration until the cache entry itself expires (up to 10 minutes by default). This undermines session termination and bearer-token lifetime controls.

Technologies: Fast-Jwt, fast-jwt (npm). Vendors: Fast-Jwt, npm.

Quick answers

Is CVE-2026-107719 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107719 being exploited in the wild.
How severe is CVE-2026-107719?
Medium severity, with a CVSS score of 4.2, published 8 October 2026.
Which products and versions are affected?
fast-jwt (npm) <= 6.3.3, SEMVER:introduced=0,fixed=6.3.4.
Is there a fix for CVE-2026-107719?
Yes. fast-jwt (npm): upgrade to 6.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107719 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-107719?
Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-jwt (npm): upgrade to 6.3.4 or later
    npm install fast-jwt@6.3.4

Technical details

The vulnerability is a logic error in cache expiration computation: the code only considers a JWT's exp (expiration) claim when an iat (issued-at) claim is present, despite iat being optional per the JWT spec. For tokens with exp but no iat, the cache falls back to a generic TTL (default 10 minutes) rather than the token's actual expiration time. Since cached tokens are returned before expiration validation occurs, an expired but previously-cached token continues to verify successfully until the cache TTL expires.

Affected products

  • fast-jwt fast-jwt

Identifiers

  • CVE-2026-107719
  • GHSA-x937-hj6v-793p

Timeline

  • 2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.