CVE-2026-107723

Summary

The fast-jwt library incorrectly accepts JWT payloads that are JSON arrays instead of objects, allowing attackers to bypass critical security checks like expiration, issuer, and audience validation. This occurs because the verifier doesn't reject array payloads, leading to silently skipped claim validations.

Exploitability

Exploitation requires an attacker who can generate or influence a validly signed JWT with an array payload, which is moderately difficult but possible in systems that accept user-provided tokens, with preconditions including the ability to craft valid signatures and control token payloads.

Blast radius

The impact could be significant across applications using fast-jwt for authentication, potentially allowing unauthorized access to protected resources by bypassing essential JWT security controls.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.3.0 or later to fix the JWT payload validation issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.