If the JWT is in a header, you should be safe. The attacker can't fool the victims browser into setting the header (unless CORS allow it, or she leverages an old Flash exploit). But lets say the attacker can control the header. Then what should she set it to? She wouldn't know.
On the other hand, if the JWT is in a cookie you will be just as vulnerable as with an ordinary session cookie. So wheater you are vulnerable or not has little to do with what kind of token you use (JWT or session ID) but more to do with where you put it (header or cookie).
Even when the authentication comes with automagic CSRF protection, you may want to consider adding a explicit CSRF protection anyway. There is always a risk that someone changes the authentication mechanism without realising it has double purposes.