fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Summary createVerifier clockTolerance: Infinity silently bypasses both exp expiry AND nbf not-before validation. Any expired or not-yet-active token is accepted as valid. The same primitive also corrupts the verifier's internal cache so cached entries inherit infinite validity — they remain valid...

NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation and persists in the verifier cache vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...

CVE-2026-107721 fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...

CVE-2026-107721

The fast-jwt library, prior to version 6.3.0 , contains a vulnerability where setting clockTolerance to Infinity bypasses both exp (expiration) and nbf (not before) validations. This occurs because the createVerifier function fails to check for finiteness during option validation. Consequently, t...