Findings

HSEC-2026-0010

Improper parsing of fractional NumericDate from JWT exp claims

Published Sep 29, 2026 · updated Sep 29, 2026

# Improper parsing of fractional from JWT claims Since its [initial commit][], package jwt uses [ ][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead to incorrect parsing of the claim in JWT payload body. PoC: The encoded claim is: 1. Explicitly allowed by RFC 7519 [section 2][rfc-2] to contain fractional part (*"... non-integer values can be represented."*); 2. Decodes correctly as (including in JS implementations on jwt.io & token.dev); 3. Decodes incorrectly as (== posix epoch ) by the library. This happens because jwt's only extracts the parsed while ignoring [ ][scientific], which in this case becomes negative non-zero. Since the standard claim carries credential expiration time: > ### [4.1.4][rfc-4.1.4]. "exp" (Expiration Time) Claim > > The "exp" (expiration time) claim identifies the expiration time on > or after which the JWT MUST NOT be accepted for processing. The > processing of the "exp" claim requires that the current date/time > MUST be before the expiration date/time listed in the "exp" claim. — this parsing mistake of dropping the exponent can have security-relevant consequences, should an attacker be able to forge JWTs with fractional expiry dates and get them fed into software that uses the library for consuming JWTs. [initial commit]: https://github.com/puffnfresh/haskell-jwt/commit/76567342c71f62f3f7554da8987579d90e532209 [rfc-2]: https://www.rfc-editor.org/info/rfc7519/#section-2 [rfc-4.1.4]: https://www.rfc-editor.org/info/rfc7519/#section-4.1.4 [scientific]: https://hackage-content.haskell.org/package/scientific-0.3.8.1/docs/Data-Scientific.html#g:2