CVE-2026-107275: Fastify JWT Authentication Bypass Vulnerability

CVE-2026-107275 Overview

CVE-2026-107275 affects @fastify/jwt, a JSON Web Token (JWT) plugin for the Fastify web framework. Versions before 10.2.3 silently drop time-span values that the plugin's parser cannot interpret. Affected inputs include compound spans, month units, ISO 8601 durations, decimal commas, and strings with surrounding whitespace. On the signing path, this produces tokens with no expiration claim. On the verification path, a configured maxAge is not enforced. The maintainers released a fix in @fastify/jwt version 10.2.3.

Critical Impact

Tokens that should expire never expire, and tokens that should be rejected for age are accepted, undermining session lifetime controls.

Affected Products

• @fastify/jwt versions prior to 10.2.3
• Fastify applications using expiresIn, notBefore, or maxAge options with string time spans
• Any downstream service that trusts JWTs issued or verified by vulnerable plugin versions

Discovery Timeline

• 2026-10-08 - CVE-2026-107275 published to the National Vulnerability Database (NVD)
• 2026-10-08 - Last updated in the NVD database

Technical Details for CVE-2026-107275

Vulnerability Analysis

The weakness is categorized as [CWE-390] Detection of Error Condition Without Action. The plugin accepts time-span strings for expiresIn, notBefore, and maxAge options. When the parser cannot interpret a string, it returns a non-finite value instead of raising an error. The plugin then proceeds as if no time constraint was supplied.

On the signing path, the resulting JWT omits the exp claim entirely. The token remains valid indefinitely. On the verification path, the configured maxAge is treated as absent. The verifier accepts tokens that should be rejected based on their age. The attack vector is network-based with high attack complexity and low privileges required, reflecting that an attacker typically needs application-level access or a misconfiguration to benefit.

Root Cause

The parser silently discards unreadable time-span inputs rather than throwing. Inputs that trigger the failure include compound spans such as 1h30m, month units such as 1 month, ISO 8601 durations such as PT1H, decimal commas such as 1,5h, and values with leading or trailing whitespace. Developers writing these values expect enforcement that never occurs.

Attack Vector

An attacker who obtains a long-lived token issued by a vulnerable configuration can reuse it beyond the intended lifetime. If maxAge is the only control enforcing session expiration, verification will not reject stale tokens. Combined with token theft or replay, this extends the window for account takeover and lateral movement. The vulnerability does not grant initial access on its own; it degrades a security control that limits the blast radius of other compromises.

See the GitHub Security Advisory GHSA-9x4w-r9p5-5h7m for technical details.

Detection Methods for CVE-2026-107275

Indicators of Compromise

• JWTs issued by the application that lack an exp claim when one was expected
• Access logs showing successful authentication with tokens older than the intended maxAge
• Dependency manifests (package.json, package-lock.json) pinning @fastify/jwt to a version earlier than 10.2.3

Detection Strategies

• Inspect application source for calls to fastify.jwt configuration that pass string values to expiresIn, notBefore, or maxAge, and verify each string parses to a finite number of seconds
• Decode sample tokens from production traffic and alert when exp is missing on token types that should expire
• Add a startup assertion that fails fast if a configured time-span option resolves to a non-finite value

Monitoring Recommendations

• Centralize JWT issuance and verification logs in a security data lake and query for tokens accepted beyond their expected lifetime
• Track dependency versions in continuous integration and flag builds that resolve @fastify/jwt below 10.2.3
• Alert on sudden drops in authentication-failure rates after a deployment, which can indicate a disabled expiration check

How to Mitigate CVE-2026-107275

Immediate Actions Required

• Upgrade @fastify/jwt to version 10.2.3 or later across all services
• Audit every expiresIn, notBefore, and maxAge option in application code and convert ambiguous strings to integer seconds
• Rotate signing keys and invalidate any long-lived tokens that may have been issued without an exp claim

Patch Information

The maintainers fixed the issue in @fastify/jwt10.2.3. The release refuses unreadable time-span inputs rather than silently dropping them. Review the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-9x4w-r9p5-5h7m for upgrade guidance.

Workarounds

• Pass expiresIn, notBefore, and maxAge as a number of seconds rather than a string
• Validate time-span strings at application startup and refuse to boot if any option parses to a non-finite value
• Enforce a secondary session-lifetime check at the application layer that does not rely on the plugin's maxAge

# Upgrade the vulnerable dependency
npm install @fastify/jwt@^10.2.3
npm ls @fastify/jwt