Security1 hOctober 9, 2026, 21:32

CVE-2026-107723: fast-jwt claim validation bypass via array payload

A type-confusion flaw in NearForm fast-jwt before 6.3.0 (CVSS 8.1) lets a validly signed JWT structured as a JSON array bypass exp, iss, aud and sub claim checks. It is patched in version 6.3.0.

DEV Community

Open source

CVE-2026-107723: fast-jwt claim validation bypass via array payload

CVSS 8.1, CWE-1287, published October 8, 2026
Affects fast-jwt below 6.3.0; patch released
Public proof-of-concept exists, not in CISA KEV
Enabling requiredClaims enforces strict verification

#Fast-jwt#NearForm

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Security

CVE-2026-103921: TLS certificate validation bypass in @graphql-tools/executor-legacy-ws

Security

CVE-2026-84428: Schema Validation Bypass in Fastify Header Normalization

Security

CVE-2026-107723: fast-jwt claim validation bypass via array payload

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

CVE-2026-103921: TLS certificate validation bypass in @graphql-tools/executor-legacy-ws

CVE-2026-84428: Schema Validation Bypass in Fastify Header Normalization

CVE-2026-103001: PyJWT state pollution bypasses claim verification