{"schema_version":"1.9.0","id":"GHSA-cjw9-ghj4-fwxf","published":"2026-04-09T16:41:40Z","modified":"2026-04-09T19:19:01.951859Z","aliases":["CVE-2026-35041"],"summary":"fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification","details":"## ⚠️ IMPORTANT CLARIFICATIONS\n\n ### Affected Configurations\n This vulnerability ONLY affects applications that:\n - Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options\n - Configure patterns susceptible to catastrophic backtracking\n - Example: `allowedAud: /^(a+)+X$/` ← VULNERABLE\n - Example: `allowedAud: \"api.company.com\"` ← SAFE\n\n ### Not Affected\n - Applications using string patterns for audience validation (most common)\n - Applications using safe RegExp patterns without nested quantifiers\n - Default fast-jwt configurations\n\n ### Assessment Guide\n To determine if you're affected:\n 1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`)\n 2. If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc.\n 3. If no RegExp usage, you are NOT affected\n\n------\n\n\n\n

Summary

A denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression.

Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification.

This occurs with a validly signed JWT, making the issue exploitable in authenticated contexts such as:

\n
API gateways
\n
\n
authentication middleware
\n
\n
service-to-service communication
\n
\n
OAuth / OIDC token validation pipelines
\n

Affected Component

\n
Library: fast-jwt
\n
\n
Version tested: 6.1.0
\n
\n
Runtime: Node.js v24.13.1
\n
\n
Feature: claim validation using allowedAud: RegExp
\n

Impact

CPU exhaustion / Denial of Service

A crafted JWT causes verification to take multiple seconds per request due to catastrophic regex backtracking.

Measured verification times

\nInput size (n) | Verification time\n-- | --\n24 | ~123 ms\n28 | ~1.97 s\n30 | ~7.85 s\n\n

This is sufficient to:

\n
block Node.js event loop threads
\n
\n
degrade API throughput
\n
\n
cause cascading service failures
\n
\n
increase serverless execution costs
\n
\n
saturate authentication infrastructure
\n

Root Cause

The library allows regular expressions in claim validation:


allowedAud: /^(a+)+X$/

The aud claim is attacker-controlled:


aud = \"a\".repeat(n) + \"Y\"

This creates catastrophic backtracking in the JavaScript regex engine.

Verification time grows exponentially as input length increases.

Exploitability

Attack requires:

\n
a valid signed JWT (post-authentication context)
\n
\n
attacker control over the aud claim
\n
\n
a vulnerable regex configured by the application
\n

Common real-world scenarios

\n
shared HS secrets
\n
\n
internal JWT issuance
\n
\n
microservice authentication
\n
\n
OAuth / OIDC custom audiences
\n
\n
internal service tokens
\n

Proof of Concept

Reproduction steps

\n
Install fast-jwt
\n
\n
Configure verifier with a RegExp in allowedAud
\n
\n
Send a valid signed JWT with adversarial aud
\n

Attached artifacts

\n
poc-suite-redos-fastjwt.js
\n
\n
evidence-redos-fastjwt.json
\n

Observed behavior

Verification CPU time increases from milliseconds to multiple seconds as input length grows.

Security Classification

\n
CWE-1333: Inefficient Regular Expression
\n
\n
CWE-400: Uncontrolled Resource Consumption
\n
\n
Class: Authenticated Denial of Service
\n

Expected Behavior

The library should prevent unbounded CPU work on attacker-controlled claims.

Possible mitigations

\n
safe-regex validation
\n
\n
maximum length enforcement for claims
\n
\n
regex complexity limits
\n
\n
documentation warning about ReDoS risks when using RegExp-based validation
\n

Notes

Signature verification occurs before claim validation, therefore this is not a pre-authentication DoS.

However, the vulnerability remains exploitable in authenticated or token-bearing contexts and can significantly impact production environments.

\n\n","affected":[{"package":{"name":"fast-jwt","ecosystem":"npm","purl":"pkg:npm/fast-jwt"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"6.2.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 6.2.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-cjw9-ghj4-fwxf/GHSA-cjw9-ghj4-fwxf.json"}}],"references":[{"type":"WEB","url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35041"},{"type":"WEB","url":"https://github.com/nearform/fast-jwt/pull/595"},{"type":"WEB","url":"https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94"},{"type":"PACKAGE","url":"https://github.com/nearform/fast-jwt"},{"type":"WEB","url":"https://github.com/nearform/fast-jwt/releases/tag/v6.2.1"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-04-09T16:41:40Z","nvd_published_at":"2026-04-09T16:16:27Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H"}]}