Is CVE-2026-107721 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107721 being exploited in the wild.

How severe is CVE-2026-107721?

Medium severity, with a CVSS score of 5.9, published 8 October 2026.

Which products and versions are affected?

Fast-Jwt v1.5.1 and later; fast-jwt (npm) <= 6.2.4, SEMVER:introduced=0,fixed=6.3.0.

How is CVE-2026-107721 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107721?

Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107721: fast-jwt clockTolerance validation bypass in expiry and not-before checks

Q: Is there a fix for CVE-2026-107721?

Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Do not configure clockTolerance to Infinity. Ensure all environment variables and configuration files that set clockTolerance use finite, non-negative numeric values. Review and restrict access to configuration mechanisms that could introduce Infinity values (e.g., JSON parsing of user-controlled or loosely-typed config). [{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-107721 · Severity: medium · CVSS 5.9 · Published 2026-10-08

fast-jwt is a JavaScript library for signing and verifying JSON Web Tokens (JWTs). When configured with clockTolerance set to Infinity, the library silently bypasses both token expiration and not-before date validation, accepting any expired or future-dated tokens as valid. This can persist in the verifier's cache, leaving tokens valid long after the misconfiguration is removed.

Technologies: Fast-Jwt, fast-jwt (npm). Vendors: Fast-Jwt, npm.

Quick answers

Is CVE-2026-107721 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107721 being exploited in the wild.
How severe is CVE-2026-107721?: Medium severity, with a CVSS score of 5.9, published 8 October 2026.
Which products and versions are affected?: Fast-Jwt v1.5.1 and later; fast-jwt (npm) <= 6.2.4, SEMVER:introduced=0,fixed=6.3.0.
Is there a fix for CVE-2026-107721?: Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Do not configure clockTolerance to Infinity. Ensure all environment variables and configuration files that set clockTolerance use finite, non-negative numeric values. Review and restrict access to configuration mechanisms that could introduce Infinity values (e.g., JSON parsing of user-controlled or loosely-typed config).</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107721 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107721?: Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-jwt (npm): upgrade to 6.3.0 or later
```
npm install fast-jwt@6.3.0
```

Do not configure clockTolerance to Infinity. Ensure all environment variables and configuration files that set clockTolerance use finite, non-negative numeric values. Review and restrict access to configuration mechanisms that could introduce Infinity values (e.g., JSON parsing of user-controlled or loosely-typed config).</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}]

Technical details

The vulnerability is a validation failure in src/verifier.js that accepts Number.Infinity for the clockTolerance option (which should only accept finite, non-negative numbers). When Infinity is passed, the additive arithmetic in claim validators produces ±Infinity, causing date comparisons to always evaluate as true. Additionally, the cache mechanism stores entries with [min=-Infinity, max=Infinity] bounds, causing cached tokens to remain valid even after the misconfiguration is reverted until LRU eviction occurs.

Affected products

fast-jwt fast-jwt v1.5.1 and later

Identifiers

CVE-2026-107721
GHSA-687g-22h4-j4w4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.