CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Using stateful RegExp modifiers in fast-jwt validation options causes valid tokens to be rejected, leading to service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35040?
CVE-2026-35040 is a medium-severity denial of service vulnerability in nearform fast-jwt, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.
Which versions are affected by CVE-2026-35040?
2 open source packages ship an affected version, including fast-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-jwt npm | All versions | 6.2.1 |
fast-jwt npm | All versions | 6.2.1 |
Products include Nearform Fast-Jwt.
How do I fix CVE-2026-35040?
Upgrade fast-jwt to 6.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35040 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35040 exists.
Other vulnerabilities in nearform fast-jwt
- CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
- CVE-2026-35039 fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
- CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2023-48223 fast-jwt JWT Algorithm Confusion
- CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Sources
Also known as GHSA-3j8v-cgw4-2g6q.