{"id":"EUVD-2026-20899","enisaUuid":"4712a606-0c6a-3ed0-881a-35be51c02af2","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.","datePublished":"Apr 9, 2026, 2:55:22 PM","dateUpdated":"Apr 9, 2026, 4:15:25 PM","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf\nhttps://github.com/nearform/fast-jwt/pull/595\nhttps://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.2.1\n","aliases":"CVE-2026-35041\nGHSA-cjw9-ghj4-fwxf\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"e01aadd0-5609-3d8f-9bc5-e31a2c7130dd","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"5.0.0, \u003c 6.2.1"}],"enisaIdVendor":[{"id":"3296ccdf-9fc1-3a0f-acbf-ade770c13938","vendor":{"name":"nearform"}}],"enisaIdVulnerability":[{"id":"66d96cb5-cda1-3bf5-a161-dcf089b26e82","vulnerability":{"id":"GHSA-cjw9-ghj4-fwxf","description":"fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification","datePublished":"Apr 9, 2026, 4:41:40 PM","dateUpdated":"Apr 9, 2026, 7:05:16 PM","baseScore":0.0,"references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35041\nhttps://github.com/nearform/fast-jwt/pull/595\nhttps://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94\nhttps://github.com/nearform/fast-jwt\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.2.1\n","enisa_id":"EUVD-2026-20899\n","aliases":"CVE-2026-35041\nGHSA-cjw9-ghj4-fwxf\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dbc35ab5-1f11-3ef4-be21-3cdef7e4cdc6","vulnerability":{"id":"CVE-2026-35041","description":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.","datePublished":"Apr 9, 2026, 2:55:22 PM","dateUpdated":"Apr 9, 2026, 4:15:25 PM","status":"PUBLISHED","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","references":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf\nhttps://github.com/nearform/fast-jwt/pull/595\nhttps://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94\nhttps://github.com/nearform/fast-jwt/releases/tag/v6.2.1\n","enisa_id":"EUVD-2026-20899\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"16ae5975-00f8-3e67-a8eb-cf25d87b4843","product":{"name":"fast-jwt","vendor":{"name":"nearform"}},"product_version":"5.0.0, \u003c 6.2.1"}],"vulnerabilityVendor":[{"id":"dabec36f-c87c-3376-88a6-787d99fc575e","vendor":{"name":"nearform"}}]}}],"enisaIdAdvisory":[]}