GHSA-5HJW-83FP-PHQ9 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary fast-jwt's createVerifier silently skips all configured claim validators exp, nbf, iss, aud, sub, jti, nonce when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's...

EUVD-2026-95348

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...

CVE-2026-107723

The fast-jwt library (versions prior to 6.3.0 ) is vulnerable to a silent claim-validator bypass when a JWT payload is a JSON array . The root cause is located in src/decoder.js, where the system verifies that the payload is an object but fails to reject arrays. Because the claim validator loop l...

CVE-2026-107723 fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nb...