CVE-2026-107719
published 2026-10-08CVE-2026-107719: fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed…
PriorityP420medium4.2CVSS 3.1
AVNACHPRLUINSUCLILAN
EPSS
0.23%
12.6th percentile
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nearform | fast-jwt | < 6.3.4 | 6.3.4 |
| nearform | fast-jwt | >= 0 < 6.3.4 | 6.3.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
nearform fast-jwt up to 6.3.3 Cache src/verifier.js cacheSet authentication replay
vuldb·2026-10-09·CVSS 4.2
CVE-2026-107719 [MEDIUM] nearform fast-jwt up to 6.3.3 Cache src/verifier.js cacheSet authentication replay
A vulnerability marked as critical has been reported in nearform fast-jwt up to 6.3.3. Impacted is the function cacheSet of the file src/verifier.js of the component Cache. Performing a manipulation results in authentication bypass by capture-replay.
This vulnerability is cataloged as CVE-2026-107719. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
fast-jwt: Verifier cache accepts expired JWTs without iat.
ghsa·2026-10-08
CVE-2026-107719 [MEDIUM] CWE-613 fast-jwt: Verifier cache accepts expired JWTs without iat.
fast-jwt: Verifier cache accepts expired JWTs without iat.
### Summary
`cacheSet` only derives its `exp` cache deadline inside `hasIat` (`src/verifier.js:127-140`). JWT `iat` is optional. For a valid token with `exp` but no `iat`, `cacheSet` substitutes `clockTimestamp + clockTolerance + cacheTTL` (`src/verifier.js:142-146`). Later, the cache path returns the saved payload before decoding or invoking `verifyToken` (`src/verifier.js:372-388`). Since expiration validation is in `verifyToken`, the expired token remains accepted until the cache deadline.
### Details
The bug is an expiration-check bypass caused by caching.
Normally, verification works like this:
1. Verify signature.
2. Check exp against the current time.
3. Return the JWT claims.
With caching enabled, `fast-jwt` saves succ
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-08
Published