4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35041

CVE-2026-35041: ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35041

CVE-2026-35041:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fast-jwt	npm	>= 5.0.0, <= 6.2.0	6.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the fast-jwt library, occurring when an application uses a vulnerable regular expression for JWT claim validation. The analysis of the fixing commit b0be0ca161593836a153d5180ca5358ad9b5de94 shows that the patch was applied to the createVerifier function in src/verifier.js. This function is the factory for creating token verifiers. The patch introduces a new function, checkForUnsafeRegExp, which uses the safe-regex2 library to detect potentially malicious regular expressions. The createVerifier function was modified to use this new check on all claim validation options that accept regular expressions (allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce). The vulnerability existed because createVerifier would previously accept these unsafe patterns without validation. The actual ReDoS is triggered when the anonymous function returned by createVerifier is executed with a crafted token. However, createVerifier is the named, exported function that is responsible for setting up this vulnerable state, and it is the function that was explicitly modified to fix the issue. Therefore, createVerifier is identified as the key function related to this vulnerability.

Vulnerable functions

createVerifier

src/verifier.js

The `createVerifier` function is responsible for creating a JWT verifier based on a set of options. Prior to the patch, it did not validate if the regular expressions passed in options like `allowedAud`, `allowedIss`, `allowedSub`, `allowedJti`, or `allowedNonce` were susceptible to Regular Expression Denial of Service (ReDoS). The function would accept a vulnerable RegExp pattern, and the returned anonymous verifier function would then use this pattern to test attacker-controlled claims. A malicious token could trigger catastrophic backtracking in the JavaScript regex engine, causing the CPU to spike and leading to a denial of service. The patch mitigates this by adding checks for unsafe regular expressions within `createVerifier` itself before the verifier function is created.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.