AIKIDO-2026-394471
fast-jwt is vulnerable to Authorization Bypass
81
High Risk
This Affects:
fast-jwtTL;DR
The JWT decoder verifies that the token payload is an object but omits an array guard, so a JSON array payload passes because typeof [] === 'object'. In the verifier's validation loop every claim check is skipped for an array payload because the claim in payload membership test is always false. Before the fix, a validly-signed token whose payload is an array bypasses all configured claim validators including expiry, issuer, audience, subject, and replay protection while still reporting success. The fix rejects array payloads during decoding so claim validation runs as documented.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on claim validators such as allowedIss, allowedAud, allowedSub, or expiry while a signed token payload can be a JSON array.
Background info
fast-jwt is vulnerable to Authorization Bypass in versions 0.0.1 - 6.2.4.
How to fix this
Upgrade the fast-jwt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant