Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2026-35041 — fast-jwt

🟡 CVSS 4.2 — Medium ⚠️ Exploit Public CWE-1333 OSV
4.2
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification ## ⚠️ IMPORTANT CLARIFICATIONS ### Affected Configurations This vulnerability ONLY affects applications that: - Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options - Configure patterns susceptible to catastrophic backtracking - Example: `allowedAud: /^(a+)+X$/` ← VULNERABLE - Example: `allowedAud: "api.company.com"` ← SAFE ### Not Affected - Applications using string patterns for audience validation (most common) - Applications using safe RegExp patterns without nested quantifiers - Default fast-jwt configurations ### Assessment Guide To determine if you're affected: 1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`) 2. If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc. 3. If no RegExp usage, you are NOT affected ------

Summary

A denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression.

Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification.

This occurs with a validly signed JWT, making the issue exploitable in authenticated contexts such as:

  • API gateways

  • authentication middleware

  • service-to-service communication

  • OAuth / OIDC token validation pipelines

Affected Component

  • Library: fast-jwt

  • Version tested: 6.1.0

  • Runtime: Node.js v24.13.1

  • Feature: claim validation using allowedAud: RegExp

Impact

CPU exhaustion / Denial of Service

A crafted JWT causes verification to take multiple seconds per request due to catastrophic regex backtracking.

Measured verification times

Input size (n) | Verification time -- | -- 24 | ~123 ms 28 | ~1.97 s 30 | ~7.85 s

This is sufficient to:

  • block Node.js event loop threads

  • degrade API throughput

  • cause cascading service failures

  • increase serverless execution costs

  • saturate authentication infrastructure

Root Cause

The library allows regular expressions in claim validation:

<div class="h-full min-h-0

					

									


				
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is high, an attacker needs administrative privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.
CVSS metrics in full
The score comes from this vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
  • Attack vector: Network — reachable from anywhere that can route to the service.
  • Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
  • Privileges required: High — administrative rights are needed first.
  • User interaction: Required — someone has to click, open or visit something.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: None.
  • Availability impact: High — total loss, or loss the attacker controls.
Weakness class
CVE-2026-35041 is classified as CWE-1333: Inefficient Regular Expression Complexity. A regular expression backtracks catastrophically on crafted input, consuming CPU out of proportion to input size.
Affected software
CVE-2026-35041 is recorded against 1 package.
  • fast-jwt
Timeline and source
Published on 9 April 2026 and last revised on 17 June 2026. A public exploit is known to exist, which raises the urgency of patching considerably. A vendor advisory or fix has been published. Record sourced from OSV.
References
github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Package)
github.com (Web)
Other advisories for this package
fast-jwt has other advisories on record. If you are patching this one, these are worth checking on the same host:
Same weakness in other software
These advisories are the same class of weakness (CWE-1333: Inefficient Regular Expression Complexity) in other software:

				
				

					
Details

										

						Severity
						MEDIUM
					

										

						CVSS Score
						4.2
					

										

						CVSS Vector
						CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
					

										

						CWE
						CWE-1333
					

										

						Public Exploit
						⚠️ Yes
					

										

						Source
						OSV
					

										

						Published
						2026-04-09
					

										

						Updated
						2026-08-20
					

										

						Modified
						2026-06-17
					

										
									


				
								

					
Affected Packages

					

						

							

								Software
								From version
								Fixed in
							

							
														

								fast-jwt
								—
								—
							

														
						

					

				

				
				
				

				
				
			

						

				
Similar Threats

				
			

									
			

				
Exploit Protection

				
Are you running fast-jwt?

				
CVE-2026-35041 carries CVSS 4.2 Medium rating and a public exploit already exists. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

				Check My Site For CVE-2026-35041 →
				
No credit card required  ·  Results in minutes

			

			
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

✓