# CVE-2026-107721: fast-jwt clockTolerance validation bypass in expiry and not-before checks

Source: https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107721 · Severity: medium · CVSS 5.9 · Published 2026-10-08

fast-jwt is a JavaScript library for signing and verifying JSON Web Tokens (JWTs). When configured with clockTolerance set to Infinity, the library silently bypasses both token expiration and not-before date validation, accepting any expired or future-dated tokens as valid. This can persist in the verifier's cache, leaving tokens valid long after the misconfiguration is removed.

Technologies: [Fast-Jwt](https://junglewise.ai/threats/technologies/fast-jwt-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Fast-Jwt](https://junglewise.ai/threats/vendors/fast-jwt), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107721 being exploited in the wild.

**How severe is CVE-2026-107721?** Medium severity, with a CVSS score of 5.9, published 8 October 2026.

**Which products and versions are affected?** Fast-Jwt v1.5.1 and later; fast-jwt (npm) <= 6.2.4, SEMVER:introduced=0,fixed=6.3.0.

**Is there a fix for CVE-2026-107721?** Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Do not configure clockTolerance to Infinity. Ensure all environment variables and configuration files that set clockTolerance use finite, non-negative numeric values. Review and restrict access to configuration mechanisms that could introduce Infinity values (e.g., JSON parsing of user-controlled or loosely-typed config).</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107721 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107721?** Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.3.0 or later

  ```sh
  npm install fast-jwt@6.3.0
  ```


Do not configure clockTolerance to Infinity. Ensure all environment variables and configuration files that set clockTolerance use finite, non-negative numeric values. Review and restrict access to configuration mechanisms that could introduce Infinity values (e.g., JSON parsing of user-controlled or loosely-typed config).</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}]

## Technical details

The vulnerability is a validation failure in src/verifier.js that accepts Number.Infinity for the clockTolerance option (which should only accept finite, non-negative numbers). When Infinity is passed, the additive arithmetic in claim validators produces ±Infinity, causing date comparisons to always evaluate as true. Additionally, the cache mechanism stores entries with [min=-Infinity, max=Infinity] bounds, causing cached tokens to remain valid even after the misconfiguration is reverted until LRU eviction occurs.

## Affected products

- fast-jwt fast-jwt v1.5.1 and later

## Identifiers

- CVE-2026-107721
- GHSA-687g-22h4-j4w4

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)
- [fast-jwt expiration bypass in token caching](https://junglewise.ai/threats/cve-2026-107719-fast-jwt-verifier-cache-accepts-expired-jwts-without-iat)