AIKIDO-2026-208205
fast-jwt is vulnerable to Insufficient Session Expiration
59
CVE Score
Medium
Insufficient Session Expiration
TL;DR
The verifier's clockTolerance option only rejects negative numbers and does not reject a non-finite value, so configuring it as infinite disables both expiry and not-before validation. The tolerance flows into the date-claim comparisons as positive and negative infinity, making every time-based check pass unconditionally. Before the fix, expired or not-yet-active tokens are accepted as valid, and the poisoned values also corrupt the verifier's cache so affected entries stay valid until eviction. The fix requires clockTolerance to be a finite non-negative number.
How do I fix this?
Upgrade the fast-jwt library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure the verifier's clockTolerance option to a non-finite value such as Infinity.
Package
Versions
1.5.0 - 6.2.4
Fixed in 6.3.0Background info
fast-jwt is vulnerable to Insufficient Session Expiration in versions 1.5.0 - 6.2.4.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.