{"schema":"threatline.record/2","record":{"id":"CVE-2026-107275","aliases":["GHSA-9x4w-r9p5-5h7m"],"summary":"@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed","details":"@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.","categories":["Frameworks"],"product":"@fastify/jwt","vendor":"@fastify/jwt","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107275","source_modified_at":"2026-10-08T14:21:22.066Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"@fastify/jwt","vendor":"@fastify/jwt","versions":[{"versionType":"semver","status":"affected","version":"0","lessThan":"10.2.3"},{"versionType":"semver","status":"unaffected","version":"10.2.3"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/fastify/fastify-jwt/security/advisories/GHSA-9x4w-r9p5-5h7m","source_modified_at":"2026-10-08T08:16:13Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"npm","name":"@fastify/jwt"},"range":"< 10.2.3"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107275","source_modified_at":"2026-10-08T14:21:22.066Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@fastify/jwt","ecosystem":null},"version":"10.2.3","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/fastify/fastify-jwt/security/advisories/GHSA-9x4w-r9p5-5h7m","source_modified_at":"2026-10-08T08:16:13Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"npm","name":"@fastify/jwt"},"version":"10.2.3"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00312,"percentile":0.22915,"score_date":"2026-10-23"},"published_at":"2026-10-08T11:05:40.492Z","modified_at":"2026-10-08T14:21:22.066Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107275","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T14:21:22.066Z"},{"source":"GitHub Advisory Database","url":"https://github.com/fastify/fastify-jwt/security/advisories/GHSA-9x4w-r9p5-5h7m","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T08:16:13Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107275","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/fastify/fastify-jwt/security/advisories/GHSA-9x4w-r9p5-5h7m"},{"source":"CVE List","url":"https://cna.openjsf.org/security-advisories.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-08T14:21:14.347462Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T14:21:22.066Z","content_hash":"3f7350c3b41f662344c08ce29280997ccabf207adb92be50f170c3791c7596e6"}}