Token Expiration Flaw in fast-jwt by Nearform

CVE-2026-107719

What is CVE-2026-107719?

The fast-jwt library, developed by Nearform, has a vulnerability that allows a cached JSON Web Token (JWT) to remain valid beyond its expiration time under specific conditions. Before version 6.3.4, the createVerifier function's cache logic fails to properly handle tokens that lack an issued-at (iat) claim. This mismanagement allows an attacker to replay a valid bearer token even after its expiration time has passed. As a result, an attacker could extend unauthorized access until the cached entry naturally expires. Ensuring that applications using fast-jwt are updated to version 6.3.4 or higher is essential to mitigate this risk.

References