{"uuid": "cef57587-1df2-4340-a413-678a190129bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107721", "type": "seen", "source": "https://gist.github.com/alon710/67a339f177c7f516c70112e338940b19", "content": "# CVE-2026-107721: CVE-2026-107721: Time Validation Bypass in NearForm fast-jwt due to Loose Temporal Option Validation\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107721\n\n## Summary\nNearForm fast-jwt prior to version 6.3.0 is vulnerable to an input validation flaw where configuring verifier properties (such as clockTolerance, clockTimestamp, and cacheTTL) with non-finite values like Infinity or NaN allows attackers to bypass temporal claim validations, including expiration (exp) and activation (nbf) boundaries. This validation bypass can result in unauthorized session persistence and cache poisoning.\n\n## TL;DR\nA flaw in fast-jwt prior to v6.3.0 permits non-finite values (such as Infinity) to bypass validation during verifier initialization. This causes token expiration and activation checks to succeed unconditionally, resulting in complete bypass of JWT expiration controls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-613, CWE-682\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.9 (Medium)\n- **Exploit Status**: Proof of Concept (Regression Tests)\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in version 6.3.0\n\n## Affected Systems\n\n- Node.js applications running fast-jwt packages prior to version 6.3.0\n- **fast-jwt**: < 6.3.0 (Fixed in: `6.3.0`)\n\n## Mitigation\n\n- Upgrade fast-jwt to version 6.3.0 or higher\n- Implement input sanitization using Number.isFinite() on configuration properties\n- Avoid passing unsanitized external variables to verifier initialization configurations\n\n**Remediation Steps:**\n1. Execute 'npm install fast-jwt@latest' in the project directory to update the dependency\n2. Verify that package lock-files show fast-jwt version is 6.3.0 or higher\n3. Audit code for usages of createVerifier and verify that options are static or strictly validated\n\n## References\n\n- [GitHub Security Advisory GHSA-687g-22h4-j4w4](https://github.com/nearform/fast-jwt/security/advisories/GHSA-687g-22h4-j4w4)\n- [Fix Commit on GitHub](https://github.com/nearform/fast-jwt/commit/c0fb5b88b4c88ff2bdd194ca2c713599ad9e38b6)\n- [fast-jwt Release Version 6.3.0](https://github.com/nearform/fast-jwt/releases/tag/v6.3.0)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-107721)\n- [NVD Authority Record](https://nvd.nist.gov/vuln/detail/CVE-2026-107721)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107721) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T13:30:32.000000Z"}