Earlier versions of the fast-jwt library allowed the clockTolerance option to be set to Infinity because its validation rules only checked type and negativity but not finiteness. When Infinity is used, the internal date validation logic interprets positive or negative infinite modifiers so that the exp (expiration) and nbf (not‑before) claims are always considered valid. As a result, a JWT that should be rejected as expired or not yet active can be accepted, allowing an attacker who can influence the configuration to obtain unauthorized access. This vulnerability is related to CWE‑613 and CWE‑682.

Any application that includes the nearform:fast-jwt package with a version older than 6.3.0 and that allows the clockTolerance configuration to be set, typically by an administrator or through a deployment template. The issue affects all such installations regardless of the runtime environment.

The vulnerability receives a CVSS score of 5.9, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The exploitation vector requires that an attacker has sufficient privileges to set the clockTolerance option to Infinity, which usually implies access to configuration files, deployment scripts, or administrative controls. Once configured, the infinite tolerance can be cached, so the forged token may remain valid for an extended period until the cache is evicted.