fast-jwt: createVerifier accepts unsigned JWTs when key is empty and algorithms is set (CVE-2026-107720)

What happened

When createVerifier is called with a synchronous key that is an empty string or null and with a non-empty algorithms allowlist, fast-jwt treats the key as falsy and bypasses prepareKeyOrSecret. The verifier's hasKey flag is false and the empty signature avoids the verifySignature check, allowing a token with an empty signature to pass verification. Claim validators still run, but an attacker can submit tokens with arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass under those conditions.

Technical cause

A falsy synchronous key (empty string or null) causes the implementation to skip the synchronous key-preparation path (prepareKeyOrSecret). With algorithms explicitly set (non-empty allowlist) and no prepared key, the code leaves hasKey false while allowedAlgorithms remains active; an empty signature then passes the signature check. The behavior does not occur for non-empty keys, when algorithms is empty, or when using the async key resolver path.

Why it matters

An attacker can present a JWT carrying arbitrary claims and, in the vulnerable configuration, have it accepted without a valid signature. This enables authentication or authorization bypass for systems that rely on fast-jwt's createVerifier for token validation. Claim validators still run, so some checks may still block certain tokens, but signature-based assurance is effectively removed in the described scenario.

Who is affected

Applications using the fast-jwt npm package and calling createVerifier with a synchronous key that may be an empty string or null while also passing a non-empty algorithms allowlist are affected. Non-empty keys, an empty algorithms allowlist, and the async key resolver path are not affected.

Discovery and timeline

This issue was published to public vulnerability databases on 2026-10-08 and 2026-10-08 (see sources). The advisory entries for this vulnerability are recorded under the identifiers CVE-2026-107720 and GHSA-8wpc-h4q6-8fxv.

Affected versions

All releases of fast-jwt introduced at version 0 up to but not including 6.3.1 are affected. The fixed release is 6.3.1.

Fixes and mitigation

A code fix is available in fast-jwt version 6.3.1. As a mitigation until you can update, avoid calling createVerifier with a synchronous key value that may be an empty string or null; ensure the verifier key is a non-empty value or use the async key resolver path. The advisory indicates the behavior does not occur for non-empty keys, an empty algorithms list, or the async resolver.

Recommended action

Upgrade fast-jwt to 6.3.1 as soon as practicable. If immediate upgrade is not possible, ensure verifier calls provide a non-empty signing key or use the async key resolver, and review token validation configurations to avoid passing a non-empty algorithms allowlist with a potentially empty key.