CVE-2026-107721

Name of the Vulnerable Software and Affected Versions fast-jwt versions 1.5.1 through 6.2.x

Description The createVerifier() function fails to properly validate the clockTolerance option, accepting Infinity as a valid input. This occurs because the validation logic only checks if the value is a number and non-negative, but does not verify if the number is finite. When clockTolerance is set to Infinity, the validateClaimDateValue() function produces comparisons that always evaluate to true, effectively bypassing the validation of exp (expiry) and nbf (not-before) claims. This allows expired or not-yet-active tokens to be accepted as valid. Additionally, this configuration corrupts the internal verifier cache by assigning infinite bounds to cache entries, meaning tokens verified while this setting is active may remain valid in the cache until they are evicted via the Least Recently Used (LRU) mechanism, even if the configuration is later corrected.

Recommendations Update to version 6.3.0. As a temporary mitigation, avoid setting the clockTolerance parameter to Infinity in the createVerifier() function.