Executive brief
fast-jwt is a JavaScript library for signing and verifying JSON Web Tokens (JWTs). When applications configure claim validation (audience, issuer, subject, JTI, or nonce) using regular expressions with global (/g) or sticky (/y) flags, the library intermittently rejects valid tokens in an alternating pattern—approximately 50% of verification attempts fail regardless of token validity. This causes authentication flapping, retry storms, and operational disruptions in production systems relying on JWT authentication.
Technical details
The vulnerability exists in fast-jwt's validateClaimValues() function, which validates JWT claims using provided matchers. When a RegExp with /g or /y flags is passed as an allowed* option (allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce), the library reuses the same RegExp object across multiple verification calls without resetting its lastIndex property. RegExp.prototype.test() mutates lastIndex when /g or /y flags are set, causing subsequent test() calls on the same object to alternate between matching and failing. An attacker or misconfigured application can exploit this to cause logical denial-of-service: valid, properly signed JWTs are intermittently rejected. The fix, released in version 6.2.1, wraps RegExp matchers to reset lastIndex = 0 before each test() call, restoring deterministic behavior. Applications are only affected if they explicitly use RegExp objects (not strings) with /g or /y flags in allowed* options—most applications using string patterns are unaffected.
Affected products
- nearform fast-jwt <= 6.1.0
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Patched in version 6.2.1 (released same day as disclosure)