fast-jwt: Verifier cache accepts expired JWTs (CVE-2026-107719)

What happened

fast-jwt's createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token contains exp but no iat. A later cache hit returns the saved payload before verifyToken rechecks expiration, allowing replayed tokens to remain accepted until the cache entry expires. The library cannot be used to forge tokens through this issue. (Sources: OSV, NVD)

Technical cause

In src/verifier.js the cacheSet logic derives the cache deadline from the token's iat and exp only when iat is present. If iat is missing the code falls back to a generic cacheTTL, so expiration is not enforced per-token at cache-hit time. That fallback lets a cached payload be returned without a fresh expiration check. (Source: OSV)

Why it matters

An attacker who can replay the same cached bearer token can extend access until the cache entry expires. The issue does not enable forging tokens, but it increases the effective lifetime of an otherwise-expired token when caching is used. (Source: OSV)

Who is affected

Applications using the fast-jwt library with verifier caching enabled and that accept JWTs which include an exp claim but omit an iat claim are affected. The report covers the fast-jwt package in the npm ecosystem. (Sources: OSV, NVD)

Discovery and timeline

The vulnerability was published in OSV and NVD on 2026-10-08 (OSV) / 2026-10-08 (NVD). The advisory entries used here are the OSV record and the NVD entry. No additional discovery details are provided in those sources. (Sources: OSV, NVD)

Affected versions

The advisory lists fast-jwt as affected from 0 up to being fixed in 6.3.4. Users should treat versions earlier than 6.3.4 as impacted. (Source: OSV)

Fixes and mitigation

A fix is available in 6.3.4. If you cannot upgrade immediately, consider disabling verifier caching, rejecting tokens that lack an iat claim, or reducing the verifier cache TTL so that cached entries expire more quickly. Implement and test any mitigation to ensure it does not break your authentication flow. (Sources: OSV, NVD)

Recommended action

Upgrade fast-jwt to 6.3.4. If you cannot upgrade right away, disable verifier caching or ensure incoming tokens include an iat claim and shorten cache TTLs until you can apply the vendor update. Verify behavior in a staging environment before deploying to production. (Sources: OSV, NVD)