AIKIDO-2026-208205
fast-jwt is vulnerable to Insufficient Session Expiration
59
Medium Risk
This Affects:
fast-jwtTL;DR
The verifier's clockTolerance option only rejects negative numbers and does not reject a non-finite value, so configuring it as infinite disables both expiry and not-before validation. The tolerance flows into the date-claim comparisons as positive and negative infinity, making every time-based check pass unconditionally. Before the fix, expired or not-yet-active tokens are accepted as valid, and the poisoned values also corrupt the verifier's cache so affected entries stay valid until eviction. The fix requires clockTolerance to be a finite non-negative number.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure the verifier's clockTolerance option to a non-finite value such as Infinity.
Background info
fast-jwt is vulnerable to Insufficient Session Expiration in versions 1.5.0 - 6.2.4.
How to fix this
Upgrade the fast-jwt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant