---
id: "CVE-2026-89315"
kind: "vulnerability"
aliases: ["CVE-2026-89315"]
title: "Go JWT library: claim names can crash JSON marshalling via reflect panic"
severity: "medium"
cvss: 6.9
epss: 0.00253
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api-servers", "go", "jwt", "package"]
not_affected_if: ["no-untyped-claim-marshalling"]
published_at: "2026-10-23T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:38:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89315", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-89315", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Go JWT library: claim names can crash JSON marshalling via reflect panic

The JwtClaims.MarshalJSON method builds a Go struct at runtime with reflect.StructOf, using field names derived from JWT claim names. Claim names that are not valid Go identifiers, or that duplicate another field, make the call panic, which an attacker can trigger with ordinary claim names.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89315
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-89315

## From the sources

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_