# CVE-2026-107719: fast-jwt expiration bypass in token caching

Source: https://junglewise.ai/threats/cve-2026-107719-fast-jwt-verifier-cache-accepts-expired-jwts-without-iat  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107719 · Severity: medium · CVSS 4.2 · Published 2026-10-08

fast-jwt is a library for signing and verifying JSON Web Tokens (JWTs), commonly used to authenticate API requests and manage user sessions. When caching is enabled, the library incorrectly handles expiration checks for tokens that have an expiration time but lack an "issued at" claim, allowing an attacker who possesses a valid token to continue using it after expiration until the cache entry itself expires (up to 10 minutes by default). This undermines session termination and bearer-token lifetime controls.

Technologies: [Fast-Jwt](https://junglewise.ai/threats/technologies/fast-jwt-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Fast-Jwt](https://junglewise.ai/threats/vendors/fast-jwt), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107719 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107719 being exploited in the wild.

**How severe is CVE-2026-107719?** Medium severity, with a CVSS score of 4.2, published 8 October 2026.

**Which products and versions are affected?** fast-jwt (npm) <= 6.3.3, SEMVER:introduced=0,fixed=6.3.4.

**Is there a fix for CVE-2026-107719?** Yes. fast-jwt (npm): upgrade to 6.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107719 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107719?** Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.3.4 or later

  ```sh
  npm install fast-jwt@6.3.4
  ```


## Technical details

The vulnerability is a logic error in cache expiration computation: the code only considers a JWT's exp (expiration) claim when an iat (issued-at) claim is present, despite iat being optional per the JWT spec. For tokens with exp but no iat, the cache falls back to a generic TTL (default 10 minutes) rather than the token's actual expiration time. Since cached tokens are returned before expiration validation occurs, an expired but previously-cached token continues to verify successfully until the cache TTL expires.

## Affected products

- fast-jwt fast-jwt

## Identifiers

- CVE-2026-107719
- GHSA-x937-hj6v-793p

## Timeline

- 2026-10-08: disclosed

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)