CVE-2026-35041

fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.

• CWE-1333

• https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94Patch
• https://github.com/nearform/fast-jwt/pull/595Issue Tracking, Patch
• https://github.com/nearform/fast-jwt/releases/tag/v6.2.1Product, Release Notes
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxfExploit, Mitigation, Vendor Advisory
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxfExploit, Mitigation, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35036Ech0 is an open-source, self-hosted publishing platform for …7.5
• CVE-2026-35037Ech0 is an open-source, self-hosted publishing platform for …7.2
• CVE-2026-35038Signal K Server is a server application that runs on a centr…6.5
• CVE-2026-35039fast-jwt provides fast JSON Web Token (JWT) implementation. …9.1
• CVE-2026-3504The Dokan: AI Powered WooCommerce Multivendor Marketplace So…5.3
• CVE-2026-35040fast-jwt provides fast JSON Web Token (JWT) implementation. …5.3
• CVE-2026-35042fast-jwt provides fast JSON Web Token (JWT) implementation. …7.5
• CVE-2026-35043BentoML is a Python library for building online serving syst…7.8
• CVE-2026-35044BentoML is a Python library for building online serving syst…9.6
• CVE-2026-35045Tandoor Recipes is an application for managing recipes, plan…8.1
• CVE-2026-35046Tandoor Recipes is an application for managing recipes, plan…5.4
• CVE-2026-35047Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestri…9.8