CVE-2026-107723: CWE-1287: Improper Validation of Specified Type of Input in nearform fast-jwt

The fast-jwt library versions prior to 6.3.0 accept JWT payloads that are JSON arrays because the payload type check only verifies that the payload is an object but does not reject arrays. Consequently, claim validators that expect named properties like exp, nbf, iss, aud, sub, jti, or nonce do not find these claims in an array and skip validation silently. This allows an attacker who can produce or influence a validly signed token to bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can enforce presence of claims to mitigate this. Signature verification remains intact and is not bypassed. The vulnerability is fixed in version 6.3.0.

An attacker capable of producing or influencing a validly signed JWT can bypass critical claim validations such as expiry, issuer, audience, subject, revocation, and replay protections. This could lead to unauthorized access or token misuse despite valid signatures. The signature verification itself is not bypassed, so tokens must still be validly signed.

Upgrade fast-jwt to version 6.3.0 or later, where this issue is fixed. Alternatively, enable the opt-in requiredClaims option to enforce presence of expected claims and block tokens missing them. No other mitigations are indicated by the vendor advisory.