CVE-2026-107721: CWE-613: Insufficient Session Expiration in nearform fast-jwt

The fast-jwt library prior to version 6.3.0 allows an application administrator to set the clockTolerance option to Infinity. The option validation checks only type and negativity but not finiteness, enabling infinite clock tolerance. This causes the validateClaimDateValue function to always pass expiration (exp) and not-before (nbf) claim comparisons, effectively accepting expired or premature tokens. Additionally, the verifier cache uses these infinite bounds, so cached entries remain valid until eviction. This vulnerability is classified under CWE-613 (Insufficient Session Expiration) and CWE-682 (Incorrect Calculation).

An attacker with administrative privileges or equivalent configuration access can configure the verifier to accept expired or not-yet-active JWT tokens by setting clockTolerance to Infinity. This undermines token expiration enforcement, potentially allowing unauthorized access with tokens that should be invalid. The impact includes confidentiality and integrity compromise but requires privileged access to exploit.

Upgrade fast-jwt to version 6.3.0 or later, where this issue is fixed. The fix ensures proper validation of the clockTolerance option to prevent infinite values. Until upgraded, avoid setting clockTolerance to Infinity. No other mitigations are indicated.