{"action":"Upgrade fast-jwt to 6.3.4 or later.","affected":[{"fixed":"6.3.4","introduced":"0"}],"component":"fast-jwt","cve_ids":["CVE-2026-107719"],"ecosystem":"npm","epss":0.00272,"exploited":false,"fixed_versions":["6.3.4"],"ghsa_id":"GHSA-x937-hj6v-793p","id":"tcs_01M5KGHF6D818J4HD5PJ41HV6P","modified_at":"2026-10-08T22:30:41.090413721Z","published_at":"2026-10-08T22:10:35Z","references":["https://osv.dev/vulnerability/GHSA-x937-hj6v-793p","https://github.com/nearform/fast-jwt/security/advisories/GHSA-x937-hj6v-793p","https://github.com/nearform/fast-jwt/commit/fc1ddbbe5ce38066ba2cea0b0ce0233932757167","https://github.com/nearform/fast-jwt","https://github.com/nearform/fast-jwt/releases/tag/v6.3.4"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-x937-hj6v-793p","url":"https://osv.dev/vulnerability/GHSA-x937-hj6v-793p"}],"summary":"fast-jwt: Verifier cache accepts expired JWTs without iat."}