CVE-2026-35040

MEDIUM 5.3

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

CVSS Score

5.3

EPSS Score

0.1%

EPSS Percentile

19th

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.

CWE	CWE-697 CWE-440
Vendor	nearform
Product	fast-jwt
Published	Apr 9, 2026
Last Updated	Apr 13, 2026

Stay Ahead of the Next One

Get instant alerts for nearform fast-jwt

Be the first to know when new medium vulnerabilities affecting nearform fast-jwt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

nearform / fast-jwt

< 6.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q github.com: https://github.com/nearform/fast-jwt/pull/593 github.com: https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a github.com: https://github.com/nearform/fast-jwt/releases/tag/v6.2.1