https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:41:23 +0000 https://vulnerability.circl.lu/sighting/8b9bbe55-5010-44ee-9a2e-ffeb47effbdd/export {"uuid": "8b9bbe55-5010-44ee-9a2e-ffeb47effbdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5hjw-83fp-phq9", "type": "seen", "source": "https://gist.github.com/alon710/8ccb059a99b0ad46462379ed42f39677", "content": "# CVE-2026-107723: CVE-2026-107723: Silent Claim-Validator Bypass in NearForm fast-jwt via Array Payload Type Confusion\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107723\n\n## Summary\nA high-severity type-confusion vulnerability exists in NearForm fast-jwt prior to version 6.3.0. The vulnerability allows attackers to bypass crucial claim validation steps (such as expiration, issuer, audience, and subject validations) by presenting a validly signed JSON Web Token structured as a JSON array instead of a JSON object. This occurs because the library's decoder fails to reject JSON arrays during type evaluation.\n\n## TL;DR\nA type-confusion vulnerability in fast-jwt prior to 6.3.0 allows validly signed tokens structured as JSON arrays to completely bypass claim validations such as expiration (exp) and issuer (iss) verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1287: Improper Validation of Specified Type of Input\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.1\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Remediation Status**: Patched in v6.3.0\n\n## Affected Systems\n\n- Applications utilizing fast-jwt library versions prior to 6.3.0\n- **fast-jwt**: < 6.3.0 (Fixed in: `6.3.0`)\n\n## Mitigation\n\n- Upgrade fast-jwt dependency to version 6.3.0 or later.\n- Enforce strict claims verification using the opt-in requiredClaims configuration.\n- Deploy WAF rules to detect and reject base64url-encoded array payloads (beginning with the Wy pattern).\n\n**Remediation Steps:**\n1. Locate all node projects using fast-jwt as a dependency.\n2. Update package.json to reference fast-jwt version 6.3.0 or newer.\n3. Execute npm install or yarn install to update lockfiles.\n4. Ensure production environments are thoroughly redeployed and signature configurations are validated.\n5. Set requiredClaims for all configurations requiring expiration, issuer, and audience validations.\n\n## References\n\n- [GHSA-5hjw-83fp-phq9: Claim validation bypass](https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9)\n- [PR #639: Fix array payload check](https://github.com/nearform/fast-jwt/pull/639)\n- [fast-jwt v6.3.0 Release Notes](https://github.com/nearform/fast-jwt/releases/tag/v6.3.0)\n- [NVD CVE-2026-107723 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-107723)\n- [CVE-2026-107723 Record](https://www.cve.org/CVERecord?id=CVE-2026-107723)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107723) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T14:30:28.000000Z"} {"uuid": "8b9bbe55-5010-44ee-9a2e-ffeb47effbdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-5hjw-83fp-phq9", "type": "seen", "source": "https://gist.github.com/alon710/8ccb059a99b0ad46462379ed42f39677", "content": "# CVE-2026-107723: CVE-2026-107723: Silent Claim-Validator Bypass in NearForm fast-jwt via Array Payload Type Confusion\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107723\n\n## Summary\nA high-severity type-confusion vulnerability exists in NearForm fast-jwt prior to version 6.3.0. The vulnerability allows attackers to bypass crucial claim validation steps (such as expiration, issuer, audience, and subject validations) by presenting a validly signed JSON Web Token structured as a JSON array instead of a JSON object. This occurs because the library's decoder fails to reject JSON arrays during type evaluation.\n\n## TL;DR\nA type-confusion vulnerability in fast-jwt prior to 6.3.0 allows validly signed tokens structured as JSON arrays to completely bypass claim validations such as expiration (exp) and issuer (iss) verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1287: Improper Validation of Specified Type of Input\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.1\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Remediation Status**: Patched in v6.3.0\n\n## Affected Systems\n\n- Applications utilizing fast-jwt library versions prior to 6.3.0\n- **fast-jwt**: < 6.3.0 (Fixed in: `6.3.0`)\n\n## Mitigation\n\n- Upgrade fast-jwt dependency to version 6.3.0 or later.\n- Enforce strict claims verification using the opt-in requiredClaims configuration.\n- Deploy WAF rules to detect and reject base64url-encoded array payloads (beginning with the Wy pattern).\n\n**Remediation Steps:**\n1. Locate all node projects using fast-jwt as a dependency.\n2. Update package.json to reference fast-jwt version 6.3.0 or newer.\n3. Execute npm install or yarn install to update lockfiles.\n4. Ensure production environments are thoroughly redeployed and signature configurations are validated.\n5. Set requiredClaims for all configurations requiring expiration, issuer, and audience validations.\n\n## References\n\n- [GHSA-5hjw-83fp-phq9: Claim validation bypass](https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9)\n- [PR #639: Fix array payload check](https://github.com/nearform/fast-jwt/pull/639)\n- [fast-jwt v6.3.0 Release Notes](https://github.com/nearform/fast-jwt/releases/tag/v6.3.0)\n- [NVD CVE-2026-107723 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-107723)\n- [CVE-2026-107723 Record](https://www.cve.org/CVERecord?id=CVE-2026-107723)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107723) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T14:30:28.000000Z"} https://vulnerability.circl.lu/sighting/8b9bbe55-5010-44ee-9a2e-ffeb47effbdd/export Fri, 09 Oct 2026 14:30:28 +0000