CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
Attackers can bypass token expiration checks in @fastify/jwt by using unparseable time formats, allowing indefinite access with expired tokens.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107275?
CVE-2026-107275 is a medium-severity vulnerability in @fastify/jwt, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.
Which versions are affected by CVE-2026-107275?
How do I fix CVE-2026-107275?
No fix has been published for CVE-2026-107275 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107275 being exploited?
There is no known exploitation of CVE-2026-107275 in the wild and no public exploit code.
Sources
Also known as GHSA-9x4w-r9p5-5h7m.