CVE-2026-35041

fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94	Patch
https://github.com/nearform/fast-jwt/pull/595	Issue Tracking Patch
https://github.com/nearform/fast-jwt/releases/tag/v6.2.1	Product Release Notes
https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf	Exploit Mitigation Vendor Advisory
https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nearform:fast-jwt:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) fast-jwt proporciona una implementación rápida de JSON Web Token (JWT). Desde la versión 5.0.0 hasta la 6.2.0, existe una condición de denegación de servicio en fast-jwt cuando la opción de verificación allowedAud se configura utilizando una expresión regular. Debido a que la declaración aud está controlada por el atacante y la biblioteca la evalúa contra la RegExp proporcionada, un JWT manipulado puede desencadenar un retroceso catastrófico en el motor de expresiones regulares de JavaScript, lo que resulta en un consumo significativo de CPU durante la verificación. Esta vulnerabilidad se corrige en la versión 6.2.1.

Information

Published : 2026-04-09 16:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35041

Mitre link : CVE-2026-35041

CVE.ORG link : CVE-2026-35041

JSON object : View

Products Affected

nearform

fast-jwt

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-35041", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35041", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T16:14:14.434470Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nearform", "product": "fast-jwt", "versions": [{"status": "affected", "version": ">= 5.0.0, < 6.2.1"}]}]}], "published": "2026-04-09T16:16:27.383", "references": [{"url": "https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nearform/fast-jwt/pull/595", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nearform/fast-jwt/releases/tag/v6.2.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1."}, {"lang": "es", "value": "fast-jwt proporciona una implementaci\u00f3n r\u00e1pida de JSON Web Token (JWT). Desde la versi\u00f3n 5.0.0 hasta la 6.2.0, existe una condici\u00f3n de denegaci\u00f3n de servicio en fast-jwt cuando la opci\u00f3n de verificaci\u00f3n allowedAud se configura utilizando una expresi\u00f3n regular. Debido a que la declaraci\u00f3n aud est\u00e1 controlada por el atacante y la biblioteca la eval\u00faa contra la RegExp proporcionada, un JWT manipulado puede desencadenar un retroceso catastr\u00f3fico en el motor de expresiones regulares de JavaScript, lo que resulta en un consumo significativo de CPU durante la verificaci\u00f3n. Esta vulnerabilidad se corrige en la versi\u00f3n 6.2.1."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nearform:fast-jwt:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0E23134A-F7C0-40FB-AB4C-5B056C011E0B", "versionEndExcluding": "6.2.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}