Stateful Regular Expression Issues in fast-jwt by NearForm

CVE-2026-35040

What is CVE-2026-35040?

The fast-jwt library, developed by NearForm, is susceptible to issues arising from the use of certain stateful regular expression modifiers in its token verification functions. Specifically, modifiers such as /g (global matching) and /y (sticky matching) in options like allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce can result in failures during token verification. This vulnerability does not allow invalid tokens to be accepted; rather, it causes a 50% failure rate for valid tokens, leading to an inconsistent experience for users during authentication attempts. This bug has been resolved in version 6.2.1 of fast-jwt.

References