CVE-2026-107719

The fast-jwt library (prior to version 6.3.4 ) contains a vulnerability in its createVerifier cache. When caching is enabled, the system may continue to accept a signed JWT after its exp time if the token lacks an iat claim. This occurs because src/verifier.js only derives the expiration deadline...