fast-jwt fails to reject JSON array payloads during token verification because the decoder only checks for an object. As a result, the claim‑validation loop sees no standard claim fields such as exp, nbf, iss, aud, sub, jti, or nonce and silently continues, marking the token as valid. An attacker who can generate or influence a signed JWT can therefore obtain a verified payload without the token’s expiry, issuer, audience, subject, revocation, or replay protections. This allows the token to be used at will, undermining the integrity guarantees that JWTs are intended to provide.

The vulnerability affects installations of the nearform:fast-jwt library that are prior to version 6.3.0. Any application that imports this library and accepts user‑supplied JWTs is potentially impacted. Clients relying on 6.3.0 or later are not affected.

With a CVSS score of 8.1, the flaw is classified as high severity. The EPSS score is not available, and the vulnerability is not currently listed in the KEV catalog. The likely attack vector is the injection or replacement of a signed JWT accepted by an application that uses fast‑jwt for authentication, allowing remote bypass of token validation. The vulnerability does not affect signature verification itself, but it removes critical claim checks that normally enforce session expiration, issuer validation, and replay protection. If exploited, an attacker can gain unauthorized access or persist credentials beyond intended lifetimes, potentially leading to prolonged compromise of systems that rely on the library for security decisions.