CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Attackers can cause CPU exhaustion in fast-jwt by sending crafted tokens when allowedAud is configured with a vulnerable regular expression.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35041?
CVE-2026-35041 is a medium-severity denial of service vulnerability in nearform fast-jwt, published on 9 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-35041?
2 open source packages ship an affected version, including fast-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-jwt npm | From 5.0.0 | 6.2.1 |
fast-jwt npm | From 5.0.0 | 6.2.1 |
Products include Nearform Fast-Jwt.
How do I fix CVE-2026-35041?
Upgrade fast-jwt to 6.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35041 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35041 exists.
Other vulnerabilities in nearform fast-jwt
- CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
- CVE-2026-35039 fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
- CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2023-48223 fast-jwt JWT Algorithm Confusion
- CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Sources
Also known as GHSA-cjw9-ghj4-fwxf.