Type confusion in jsonwebtoken - CVE-2026-25537

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a type confusion error when parsing standard claims in an incorrect format. If a claim is provided with an incorrect JSON type, the application's internal parsing mechanism marks the claim as "FailedToParse" and the validation logic treats this state identically to "NotPresent". If this check is enabled, e.g. "validate_nbf = true" but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim. A remote attacker can bypass authorization checks and gain unauthorized access to the application. 

How to mitigate CVE-2026-25537

Sources

• https://github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01
• https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc