CVE-2026-107721

The fast-jwt library, prior to version 6.3.0 , contains a vulnerability where setting clockTolerance to Infinity bypasses both exp (expiration) and nbf (not before) validations. This occurs because the createVerifier function fails to check for finiteness during option validation. Consequently, t...

CVE-2026-107721 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...