CVE-2026-107721: fast-jwt Auth Bypass Vulnerability

CVE-2026-107721 Overview

CVE-2026-107721 affects the fast-jwt library, a high-performance JSON Web Token (JWT) implementation for Node.js. Versions prior to 6.3.0 fail to validate that the clockTolerance option is a finite number. When an administrator configures createVerifier with Infinity, expiration (exp) and not-before (nbf) claim checks always evaluate as valid. This allows expired or not-yet-active tokens to pass verification. The verifier's internal cache also inherits infinite bounds, so cached verification results persist until eviction. The flaw is categorized under [CWE-613: Insufficient Session Expiration]. Version 6.3.0 fixes the issue by rejecting non-finite values.

Critical Impact

Expired and not-yet-valid JWTs are accepted as legitimate, defeating session expiration controls and enabling prolonged use of stale credentials.

Affected Products

• fast-jwt versions prior to 6.3.0
• Node.js applications using createVerifier with administrator-controlled clockTolerance
• Downstream frameworks and services that embed fast-jwt for JWT validation

Discovery Timeline

• 2026-10-08 - CVE-2026-107721 published to NVD
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107721

Vulnerability Analysis

The fast-jwt option validator checks whether clockTolerance is a number and non-negative, but does not test for finiteness. Passing Infinity satisfies both checks and propagates into claim validation. Inside validateClaimDateValue, the tolerance is added to the current time when comparing against the exp claim and subtracted when comparing against nbf. With an infinite modifier, every comparison trivially succeeds. The verifier's cache keys and TTL calculations also use these values, so successful cache entries created under the misconfiguration remain valid indefinitely until eviction. Exploitation requires an attacker with administrator-level configuration access to set clockTolerance to Infinity, or a configuration pipeline that unsafely forwards attacker-controlled values into verifier construction.

Root Cause

The root cause is incomplete numeric input validation. The code paths for clockTimestamp, clockTolerance, and cacheTTL tested type and sign but omitted a Number.isFinite check. JavaScript treats Infinity as typeof 'number' and greater than zero, bypassing the guard. Applied to session claim comparisons, this nullifies JWT expiration semantics.

Attack Vector

An actor with configuration privileges, or who can influence configuration input flowing into createVerifier, sets clockTolerance: Infinity. Any JWT presented to the verifier afterward passes exp and nbf validation regardless of its actual timestamps. Replayed, previously revoked, or forged tokens that would normally fail the time-based claim checks become accepted session credentials.

// Security patch in src/verifier.js (fast-jwt 6.3.0)
// fix: reject non-finite clockTimestamp, clockTolerance and cacheTTL options

  if (
    clockTimestamp !== undefined &&
    (typeof clockTimestamp !== 'number' || !Number.isFinite(clockTimestamp) || clockTimestamp < 0)
  ) {
    throw new TokenError(
      TokenError.codes.invalidOption,
      'The clockTimestamp option must be a finite, non-negative number.'
    )
  }

  if (
    clockTolerance !== undefined &&
    (typeof clockTolerance !== 'number' || !Number.isFinite(clockTolerance) || clockTolerance < 0)
  ) {
    throw new TokenError(
      TokenError.codes.invalidOption,
      'The clockTolerance option must be a finite, non-negative number.'
    )
  }

  if (cacheTTL !== undefined && (typeof cacheTTL !== 'number' || !Number.isFinite(cacheTTL) || cacheTTL < 0)) {
    // ...
  }

Source: GitHub Commit c0fb5b8

Detection Methods for CVE-2026-107721

Indicators of Compromise

• Application logs showing successful JWT validation for tokens whose exp claim predates the request time.
• Authentication events reusing JWT identifiers (jti) long after their intended expiration window.
• Configuration files, environment variables, or runtime options containing clockTolerance: Infinity or equivalent string coercions.

Detection Strategies

• Audit package-lock.json and yarn.lock for fast-jwt versions below 6.3.0 using Software Composition Analysis tooling.
• Inspect all call sites of createVerifier to confirm clockTolerance, clockTimestamp, and cacheTTL receive finite numeric values.
• Add static analysis rules that flag assignments of Infinity, Number.POSITIVE_INFINITY, or unvalidated input to JWT verifier options.

Monitoring Recommendations

• Alert on authentication flows accepting tokens with past-dated exp or future-dated nbf claims.
• Correlate configuration-change events against spikes in long-lived session reuse.
• Monitor dependency manifests in CI pipelines and fail builds that resolve vulnerable fast-jwt versions.

How to Mitigate CVE-2026-107721

Immediate Actions Required

• Upgrade fast-jwt to version 6.3.0 or later across all services and container images.
• Review every createVerifier configuration and remove any non-finite values from clockTolerance, clockTimestamp, and cacheTTL.
• Rotate signing keys and invalidate active sessions if logs indicate the misconfiguration was ever deployed.

Patch Information

The fix landed in fast-jwt release v6.3.0. The patch adds Number.isFinite guards and updated error messages requiring finite, non-negative numbers. Full technical context is documented in GHSA-687g-22h4-j4w4.

Workarounds

• Wrap createVerifier construction in a helper that validates numeric options with Number.isFinite before delegation.
• Restrict administrator access to JWT verifier configuration paths and treat configuration changes as privileged operations.
• Enforce a sane upper bound (for example, 300 seconds) on clockTolerance through configuration schema validation.

# Upgrade to the patched release
npm install fast-jwt@^6.3.0

# Verify no vulnerable versions remain in the dependency tree
npm ls fast-jwt