{"action":"Upgrade fast-jwt to 6.3.0 or later.","affected":[{"fixed":"6.3.0","introduced":"0"}],"component":"fast-jwt","cve_ids":["CVE-2026-107723"],"ecosystem":"npm","epss":0.00358,"exploited":false,"fixed_versions":["6.3.0"],"ghsa_id":"GHSA-5hjw-83fp-phq9","id":"tcs_01M5KF3XMR8S6T608YCGBKQ0YR","modified_at":"2026-10-08T22:15:05.904211357Z","published_at":"2026-10-08T22:01:58Z","references":["https://osv.dev/vulnerability/GHSA-5hjw-83fp-phq9","https://github.com/nearform/fast-jwt/security/advisories/GHSA-5hjw-83fp-phq9","https://github.com/nearform/fast-jwt/pull/639","https://github.com/nearform/fast-jwt/commit/86e83efd8b5244f50859532d99244f0a9a9a4368","https://github.com/nearform/fast-jwt","https://github.com/nearform/fast-jwt/releases/tag/v6.3.0"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-5hjw-83fp-phq9","url":"https://osv.dev/vulnerability/GHSA-5hjw-83fp-phq9"}],"summary":"fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array"}