CVE-2026-35040 json
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
published 2026-04-09 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-20898 , GHSA-3j8v-cgw4-2g6q
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.
Patch / fix
- npm fast-jwt 6.2.1
- nearform fast-jwt 6.2.1
- github.com/nearform/fast-jwt@18d2590 commit
- github.com/nearform/fast-jwt#593 pull request
- github.com/nearform/fast-jwt/releases/tag/v6.2.1 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | fast-jwt | <6.2.1 |
6.2.1 |
Affected products
- nearform fast-jwt
Classification
References
-
github.com
/nearform/fast-jwt/pull/593
web, issue-tracking, patch
-
github.com
/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
web, patch
-
github.com
/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
web, exploit, mitigation, vendor-advisory
-
github.com
/nearform/fast-jwt/releases/tag/v6.2.1
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-35040
advisory
-
github.com
/nearform/fast-jwt
package
Sources
- CVE List CVE-2026-35040
- GitHub Advisory GHSA-3j8v-cgw4-2g6q
- NVD CVE-2026-35040
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.