CVE-2026-107721: 
JavaScript vulnerability analysis and mitigation

CVE-2026-107721 is an authentication bypass vulnerability in the fast-jwt npm library (by Nearform) where setting clockTolerance: Infinity silently disables both exp (expiry) and nbf (not-before) JWT claim validation. All versions up to and including 6.2.4 are affected; the issue was introduced when clockTolerance support was first added in v1.5.1. The vulnerability was discovered by independent security researcher Andrew Ridings, first published to the GitHub Advisory Database on July 28, 2026, and formally assigned CVE-2026-107721 on October 8, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory).

The root cause is an incomplete input validation check (CWE-682: Incorrect Calculation; CWE-613: Insufficient Session Expiration) in src/verifier.js. The option validation guard checks only that clockTolerance is a number and non-negative (clockTolerance < 0), but does not check for finiteness — so Infinity passes silently. When Infinity flows into validateClaimDateValue(), the adjusted timestamp becomes ±Infinity, making all exp and nbf comparisons trivially true (always-pass). A secondary effect corrupts the LRU verifier cache: cache entries computed with clockTolerance: Infinity receive [min=-Infinity, max=Infinity] bounds, causing them to remain valid indefinitely until evicted — even after the misconfiguration is corrected. Notably, the signer-side (signer.js) already correctly uses Number.isFinite() to reject Infinity for expiresIn and notBefore, making this an asymmetric hardening gap (Github Advisory, Patch Commit).

Successful exploitation allows any expired or not-yet-active JWT token to be accepted as valid, effectively bypassing authentication and session expiration controls. An attacker who possesses a previously valid but expired token can reuse it indefinitely to impersonate users, access protected resources, and potentially escalate privileges within the application. The cache corruption side-effect means that even after a developer corrects the misconfiguration, previously cached tokens continue to be accepted until LRU eviction (default cache size: 1,000 entries), extending the window of exposure. Confidentiality and integrity impacts are rated High, with no availability impact (Github Advisory).

Exploitation requires that an application administrator or developer has (mis)configured the verifier with clockTolerance: Infinity — a high-privilege precondition that limits the attack surface. No public proof-of-concept exploit code beyond the empirical PoC included in the security advisory itself is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.334%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a misconfigured deployment: Determine that the target application uses fast-jwt <= 6.2.4 and that the verifier is configured with clockTolerance: Infinity (e.g., via source code review, leaked config files, or environment variable inspection).
2. Obtain an expired or not-yet-active JWT: Acquire a previously valid JWT token that has since expired, or craft a token with an nbf claim set in the future. The token must be signed with the correct secret/key.
3. Submit the token to the target application: Send the expired or future-dated token in an HTTP request (e.g., Authorization: Bearer <token>) to a protected endpoint.
4. Bypass validation: Because clockTolerance: Infinity causes validateClaimDateValue() to always return true, the verifier accepts the token as valid regardless of its exp or nbf claims.
5. Leverage cached bypass (optional): If the misconfiguration was previously active and then removed, cached tokens with infinite validity bounds may still be accepted — submit a token that was verified during the misconfiguration window to exploit the cache side-effect until LRU eviction occurs (Github Advisory).

• Logs: Application authentication logs showing successful token verifications for tokens with exp timestamps in the past or nbf timestamps in the future; absence of expected token expiry errors in JWT middleware logs.
• Configuration: Presence of clockTolerance: Infinity (or the string "Infinity" cast to a number) in application configuration files, environment variables, or source code passed to createVerifier().
• Application Behavior: Users or sessions remaining authenticated well beyond expected token lifetimes; repeated successful API calls using tokens that should have been rejected as expired.
• Cache State: LRU cache entries in the fast-jwt verifier with min=-Infinity and max=Infinity bounds, observable via application memory inspection or debug logging if enabled (Github Advisory).

Upgrade fast-jwt to version 6.3.0 or later, which adds Number.isFinite() checks to reject Infinity (and NaN) for clockTolerance, clockTimestamp, and cacheTTL options, throwing a TokenError with the message 'The clockTolerance option must be a finite, non-negative number.' (Release v6.3.0, Patch Commit). If upgrading immediately is not possible, audit all usages of createVerifier() to ensure clockTolerance is never set to Infinity; implement external token expiry validation as a compensating control. After upgrading, restart the application to flush the LRU cache and clear any cached tokens with infinite validity bounds.

The vulnerability was reported by independent security researcher Andrew Ridings and coordinated through GitHub's private security advisory process before public disclosure. The advisory notes an asymmetric hardening gap — the signer-side already used Number.isFinite() correctly — which the maintainers addressed promptly in v6.3.0 alongside several other security fixes in the same release (Github Advisory, Release v6.3.0). No significant broader media coverage or notable social media discussion has been identified beyond the advisory itself.