CVE-2026-107723: fast-jwt claim-validator bypass with JSON array payload

CVE-2026-107723 · Severity: high · CVSS 8.1 · Published 2026-10-08

fast-jwt is a library for signing and verifying JSON Web Tokens, which are used for authentication and authorization across services. The library silently skips all claim validation (expiry, issuer, audience, subject, nonce checks) when a JWT's payload is a JSON array instead of the required object, allowing attackers to forge tokens that bypass all configured security checks while keeping the signature valid. This enables attackers to craft tokens that never expire, impersonate other services, or replay tokens across systems.

Technologies: Fast-Jwt, fast-jwt (npm). Vendors: Fast-Jwt, npm.

Quick answers

Is CVE-2026-107723 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107723 being exploited in the wild.
How severe is CVE-2026-107723?
High severity, with a CVSS score of 8.1, published 8 October 2026.
Which products and versions are affected?
Fast-Jwt v6.2.4 and earlier; fast-jwt (npm) <= 6.2.4, SEMVER:introduced=0,fixed=6.3.0.
Is there a fix for CVE-2026-107723?
Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Add `Array.isArray(payload)` to the payload validation in src/decoder.js:65 to reject array payloads the same way the header validation does, ensuring only JSON objects are accepted as JWT Claims Sets.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107723 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-107723?
Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-jwt (npm): upgrade to 6.3.0 or later
    npm install fast-jwt@6.3.0

Add `Array.isArray(payload)` to the payload validation in src/decoder.js:65 to reject array payloads the same way the header validation does, ensuring only JSON objects are accepted as JWT Claims Sets.</anigation> </invoke>

Technical details

The vulnerability is a logic error in the decoder's payload validation: while the header is correctly checked with `!Array.isArray(header)`, the payload check omits this guard, allowing arrays to pass since `typeof [] === 'object'` in JavaScript. Subsequently, all claim validators use `if (!(claim in payload))` to access claim properties, which is always false for numeric-indexed arrays, causing every validator (exp, nbf, iss, aud, sub, jti, nonce) to silently continue without enforcement, violating RFC 7519 §7.2. Only the signature verification runs; the verifier returns success and the array payload to the caller without error or warning.

Affected products

  • fast-jwt fast-jwt v6.2.4 and earlier

Identifiers

  • CVE-2026-107723
  • GHSA-5hjw-83fp-phq9

Timeline

  • 2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.