fast-jwt: Verifier cache accepts expired JWTs without iat.

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

GHSA-X937-HJ6V-793P fast-jwt: Verifier cache accepts expired JWTs without iat.

Summary cacheSet only derives its exp cache deadline inside hasIat src/verifier.js:127-140. JWT iat is optional. For a valid token with exp but no iat, cacheSet substitutes clockTimestamp + clockTolerance + cacheTTL src/verifier.js:142-146. Later, the cache path returns the saved payload before...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...

CVE-2026-107719

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

PT-2026-108248

Name of the Vulnerable Software and Affected Versions fast-jwt versions prior to 6.3.4 Description An expiration-check bypass exists when caching is enabled. The createVerifier cache may continue accepting a signed JSON Web Token JWT after its expiration time if the token contains an exp expirati...