fastify fastify-jwt up to 10.2.2 Parser expiresIn/notBefore/maxAge input validation

Summaryinfo

A vulnerability classified as critical was found in fastify fastify-jwt up to 10.2.2. This affects an unknown function of the component Parser. Executing a manipulation of the argument expiresIn/notBefore/maxAge can lead to input validation. The identification of this vulnerability is CVE-2026-107275. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in fastify fastify-jwt up to 10.2.2. This vulnerability affects an unknown function of the component Parser. The manipulation of the argument expiresIn/notBefore/maxAge with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-107275 since 10/07/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 10.2.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• fastify

Name

• fastify-jwt

Version

• 10.2.0
• 10.2.1
• 10.2.2

Website

• Product: https://github.com/fastify/fastify-jwt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion