# CVE-2026-107723: fast-jwt claim-validator bypass with JSON array payload

Source: https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107723 · Severity: high · CVSS 8.1 · Published 2026-10-08

fast-jwt is a library for signing and verifying JSON Web Tokens, which are used for authentication and authorization across services. The library silently skips all claim validation (expiry, issuer, audience, subject, nonce checks) when a JWT's payload is a JSON array instead of the required object, allowing attackers to forge tokens that bypass all configured security checks while keeping the signature valid. This enables attackers to craft tokens that never expire, impersonate other services, or replay tokens across systems.

Technologies: [Fast-Jwt](https://junglewise.ai/threats/technologies/fast-jwt-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Fast-Jwt](https://junglewise.ai/threats/vendors/fast-jwt), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107723 being exploited in the wild.

**How severe is CVE-2026-107723?** High severity, with a CVSS score of 8.1, published 8 October 2026.

**Which products and versions are affected?** Fast-Jwt v6.2.4 and earlier; fast-jwt (npm) <= 6.2.4, SEMVER:introduced=0,fixed=6.3.0.

**Is there a fix for CVE-2026-107723?** Yes. fast-jwt (npm): upgrade to 6.3.0 or later. Until then: Add `Array.isArray(payload)` to the payload validation in src/decoder.js:65 to reject array payloads the same way the header validation does, ensuring only JSON objects are accepted as JWT Claims Sets.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107723 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107723?** Check whether you run Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.3.0 or later

  ```sh
  npm install fast-jwt@6.3.0
  ```


Add `Array.isArray(payload)` to the payload validation in src/decoder.js:65 to reject array payloads the same way the header validation does, ensuring only JSON objects are accepted as JWT Claims Sets.</anigation>
</invoke>

## Technical details

The vulnerability is a logic error in the decoder's payload validation: while the header is correctly checked with `!Array.isArray(header)`, the payload check omits this guard, allowing arrays to pass since `typeof [] === 'object'` in JavaScript. Subsequently, all claim validators use `if (!(claim in payload))` to access claim properties, which is always false for numeric-indexed arrays, causing every validator (exp, nbf, iss, aud, sub, jti, nonce) to silently continue without enforcement, violating RFC 7519 §7.2. Only the signature verification runs; the verifier returns success and the array payload to the caller without error or warning.

## Affected products

- fast-jwt fast-jwt v6.2.4 and earlier

## Identifiers

- CVE-2026-107723
- GHSA-5hjw-83fp-phq9

## Timeline

- 2026-10-08: disclosed

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)
- [fast-jwt expiration bypass in token caching](https://junglewise.ai/threats/cve-2026-107719-fast-jwt-verifier-cache-accepts-expired-jwts-without-iat)