5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35040

CVE-2026-35040: fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35040

CVE-2026-35040:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fast-jwt	npm	< 6.2.1	6.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a logical denial-of-service in the fast-jwt library caused by the incorrect handling of stateful regular expressions. When a RegExp with a global (/g) or sticky (/y) flag is used in options like allowedAud, allowedIss, etc., the RegExp.prototype.test() method becomes stateful. The library reuses the same RegExp object for multiple validations without resetting the lastIndex property, which is mutated by test(). This results in an alternating PASS/FAIL validation for the same, valid JWT, leading to intermittent authentication failures.

The analysis of the provided patch 18d25904e4617e8753526d1b3ab5a2cccdea726a confirms this. The fix is in the ensureStringClaimMatcher function in src/verifier.js. This function is modified to wrap any RegExp object in a new object. This wrapper's test method resets the lastIndex of the original RegExp to 0 before calling its test method, thus ensuring the validation is deterministic.

The vulnerability description also explicitly identifies validateClaimValues as the function that performs the vulnerable action by calling a.test(v) on the stateful RegExp. Therefore, during runtime exploitation, validateClaimValues is the function where the non-deterministic behavior is exhibited, while ensureStringClaimMatcher is the function that creates the vulnerable condition during the verifier's setup.

Vulnerable functions

ensureStringClaimMatcher

src/verifier.js

This function processes the `allowed*` claim validation options. Prior to the patch, it would return a raw RegExp object if one was provided. If this RegExp used stateful flags like `/g` or `/y`, it would lead to non-deterministic behavior in the validation logic. The patch fixes this by wrapping the RegExp in an object that resets the `lastIndex` property before each `test()` call.

validateClaimValues

src/verifier.js

This function is where the actual claim validation occurs. It iterates over the matchers prepared by `ensureStringClaimMatcher` and calls the `test()` method. When a stateful RegExp is used, this function's repeated calls to `test()` without resetting `lastIndex` cause the validation to alternate between success and failure for the same valid token, triggering the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.