CVE-2026-107723: fast-jwt Authentication Bypass Vulnerability

CVE-2026-107723 Overview

CVE-2026-107723 is an authentication bypass vulnerability in the fast-jwt library, a widely used fast JSON Web Token (JWT) implementation for Node.js. Versions prior to 6.3.0 accept validly signed tokens whose payload is a JSON array rather than an object. The decoder validates that the payload is of type object but fails to reject arrays, which are also typed as objects in JavaScript. The claim validator loop then finds no exp, nbf, iss, aud, sub, jti, or nonce properties on the array and silently skips every configured check. The library returns the array as a successfully verified payload. This issue is categorized under [CWE-1287] Improper Validation of Specified Type of Input.

Critical Impact
Attackers who can produce or influence a validly signed token can bypass expiry, issuer, audience, subject, revocation, and replay protections while retaining a verified token status.

Affected Products

fast-jwt versions prior to 6.3.0
Node.js applications relying on createVerifier for JWT claim validation
Services using fast-jwt without the opt-in requiredClaims option

Discovery Timeline

2026-10-08 - CVE-2026-107723 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107723

Vulnerability Analysis

The flaw lives in src/decoder.js within the fast-jwt library. After signature verification, the decoder checks whether the decoded payload is a non-null object. Because typeof [] === 'object' in JavaScript, a JSON array payload passes this guard. The downstream claim validator iterates over expected named claims such as exp, nbf, iss, aud, sub, jti, and nonce. None of these exist as named properties on an array, so each validation step is skipped without raising an error.

The practical result is a verified token that carries no enforceable expiry, issuer, audience, or replay controls. Any downstream code that trusts the verifier's success contract will accept a stale or misdirected token. Signature verification itself is not bypassed, so an attacker must still obtain or influence a validly signed token, for example through a leaked signing key, a shared signing service, or a chained token-issuance flaw.

Root Cause

The root cause is incomplete type validation. The decoder asserts object-ness without rejecting array instances, which are a distinct JSON type that cannot carry the named claims the validator expects. The silent skip behavior in the claim loop compounds the error by returning success instead of raising when no claims are found.

Attack Vector

An attacker with the ability to craft or obtain a signed JWT whose payload is a JSON array (for example ["admin"]) can present that token to any service using a vulnerable fast-jwt verifier. The verifier returns the array as the validated payload, and all claim-based policy checks are skipped. This enables token replay beyond expiry, cross-tenant use across audiences, and bypass of revocation lists keyed on jti.

javascript

// Patch in src/decoder.js — fix: reject JSON array payloads in decoder (#639)
//  10. Verify that the resulting octet sequence is a UTF-8-encoded
//      representation of a completely valid JSON object conforming to
//      RFC 7159 [RFC7159]; let the JWT Claims Set be this JSON object.
- if (!payload || typeof payload !== 'object') {
+ if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
    throw new TokenError(TokenError.codes.invalidPayload, 'The payload must be an object', { payload })
  }

Source: GitHub Commit 86e83ef. The patch adds an explicit Array.isArray(payload) check so array payloads are rejected before claim validation runs.

Detection Methods for CVE-2026-107723

Indicators of Compromise

Verified JWT payloads logged as arrays rather than objects in application or gateway telemetry.
Authenticated requests referencing expired iat timestamps or missing standard claims entirely.
Successful authorization events for tokens whose decoded payload lacks exp, iss, or aud fields.

Detection Strategies

Inventory Node.js services for fast-jwt dependencies below version 6.3.0 using Software Composition Analysis (SCA) or npm ls fast-jwt.
Add middleware that rejects any verified payload where Array.isArray(payload) is true, independent of the library version.
Enable structured logging on JWT verification outcomes and alert on payloads lacking expected named claims.

Monitoring Recommendations

Monitor authentication logs for tokens that pass verification but carry no exp or jti, indicating potential array-payload bypass.
Track dependency drift in CI pipelines so vulnerable fast-jwt versions cannot be reintroduced after remediation.
Correlate JWT verification events with downstream authorization decisions to surface tokens that skipped claim enforcement.

How to Mitigate CVE-2026-107723

Immediate Actions Required

Upgrade fast-jwt to version 6.3.0 or later across all Node.js services and build artifacts.
Enable the opt-in requiredClaims option on every createVerifier instance to force rejection of tokens missing expected named claims.
Rotate signing keys if there is any evidence that array-payload tokens were accepted in production.

Patch Information

The fix is published in fast-jwt v6.3.0 and tracked in GHSA-5hjw-83fp-phq9. The remediation discussion is available in Pull Request #639. The patch adds Array.isArray(payload) to the payload type check in src/decoder.js.

Workarounds

Configure createVerifier with requiredClaims: ['exp', 'iss', 'aud'] or the equivalent set for your token policy to block tokens missing named claims.
Wrap the verifier output with a guard that rejects payloads where Array.isArray(decoded) === true before granting access.
Restrict token issuance paths so attackers cannot influence payload structure at the signer.

bash

# Upgrade fast-jwt to the patched release
npm install fast-jwt@^6.3.0

# Verify the installed version no longer matches vulnerable ranges
npm ls fast-jwt