CVE-2026-107275 @fastify/jwt CVE debrief

Who should care

Defenders who use the @fastify/jwt package in their applications should assess their exposure and upgrade to version 10.2.3 or later to fix the vulnerability. This is particularly important for roles responsible for maintaining and securing Fastify web framework applications.

Why it matters

Defenders should care about CVE-2026-107275 because it affects the @fastify/jwt package, which is used for JSON Web Token management in Fastify web framework applications. The vulnerability can lead to tokens being issued without proper expiration or maxAge enforcement, potentially allowing indefinite token validity or acceptance of older tokens. This requires verification and potential upgrades to ensure secure token management.

• Tokens may be issued without expiration, potentially leading to indefinite validity
• Configured maxAge may not be enforced on token verification, allowing older tokens to be accepted

Technical summary

The @fastify/jwt package has a vulnerability in versions before 10.2.3 where a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read is silently dropped. This results in a token with no expiration claim that never expires on the signing path, and on the verification path, a configured maxAge stops being enforced. The issue arises from the plugin's inability to properly parse certain time span formats, such as compound spans, month units, ISO 8601 durations, decimal commas, or values with surrounding whitespace. Consequently, tokens may be issued without proper expiration or maxAge enforcement, potentially allowing indefinite token validity or acceptance of older tokens. To fix

Defensive priority

Upgrade to @fastify/jwt 10.2.3 or later to fix the vulnerability. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.

Recommended defensive actions

• Upgrade to @fastify/jwt 10.2.3 or later
• Pass time-span options as a number of seconds
• Verify that any time-span string parses to a finite value before relying on it
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and fixed version. The @fastify/jwt package, a JSON Web Token plugin for the Fastify web framework, has a vulnerability in versions before 10.2.3. This vulnerability occurs when a time span is passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace. As a result, the token may have

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.