CVE-2026-107721: fast-jwt Bypass of Expiry and Not-Before Validation
Summary
CVE-2026-107721: createVerifier({ clockTolerance: Infinity }) silently bypasses both exp (expiry) AND nbf (not-before) validation. Affects fast-jwt versions < 6.3.0. Fixed in 6.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-jwt is a lightweight JSON Web Token (JWT) library for Node.js that provides functionality for signing and verifying tokens. It is designed to be simple and efficient, allowing developers to easily implement JWT authentication in their applications. However, a significant vulnerability has been identified that allows tokens to bypass expiry and not-before validation when configured incorrectly.
Vulnerability Detail
The vulnerability arises from the use of 'clockTolerance: Infinity' in the createVerifier function, which silently bypasses both 'exp' (expiry) and 'nbf' (not-before) validation. This means that any expired or not-yet-active token is accepted as valid. The issue is compounded by the fact that this configuration corrupts the verifier's internal cache, causing cached entries to inherit infinite validity. As a result, developers may unknowingly allow invalid tokens to be accepted, posing a serious security risk.
How To Fix
Latest published version: 6.3.5 as of 22 Oct 2026
npm install fast-jwt@6.3.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.3.0
This is the first release that contains the fix.
npm install fast-jwt@6.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, avoid using 'clockTolerance: Infinity' in your configuration. Instead, set a reasonable value, such as 60 seconds, to ensure proper validation of token expiry and not-before claims.
Conclusion
The fast-jwt library has a critical vulnerability that can lead to the acceptance of invalid tokens if misconfigured. It is essential for developers to update to the patched version and ensure proper configuration to maintain the security of their applications.
See every vulnerability recorded for fast-jwt →
FAQ
The vulnerability allows expired or not-yet-active tokens to be accepted as valid, which can lead to unauthorized access and security breaches.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
As a temporary measure, avoid using 'clockTolerance: Infinity' and set a finite value to ensure proper validation of tokens.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
The vulnerability was reported by Andrew Ridings, an independent security researcher.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-jwt.
