Denial-of-Service Vulnerability in Fast-JWT Library by Nearform

CVE-2026-35041

What is CVE-2026-35041?

The fast-jwt library, a fast implementation of JSON Web Token (JWT), contains a vulnerability that allows for a denial-of-service condition. When the 'allowedAud' verification option is utilized with a regular expression, crafted JWTs can be manipulated to trigger catastrophic backtracking in JavaScript’s regex engine. This results in excessive CPU usage during token verification, which can severely impact performance. The issue is resolved in version 6.2.1 of fast-jwt, emphasizing the importance of updating to mitigate potential risks.

References