# CVE-2026-35040: fast-jwt stateful RegExp causes non-deterministic claim validation

Source: https://junglewise.ai/threats/cve-2026-35040-nearform-fast-jwt-non-deterministic-validation-in-claim-matcher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35040 · Severity: medium · CVSS 5.3 · Published 2026-04-09

fast-jwt is a JavaScript library for signing and verifying JSON Web Tokens (JWTs). When applications configure claim validation (audience, issuer, subject, JTI, or nonce) using regular expressions with global (/g) or sticky (/y) flags, the library intermittently rejects valid tokens in an alternating pattern—approximately 50% of verification attempts fail regardless of token validity. This causes authentication flapping, retry storms, and operational disruptions in production systems relying on JWT authentication.

Technologies: [Nearform Fast-Jwt](https://junglewise.ai/threats/technologies/nearform-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Nearform](https://junglewise.ai/threats/vendors/nearform), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-35040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35040 being exploited in the wild.

**How severe is CVE-2026-35040?** Medium severity, with a CVSS score of 5.3, published 9 April 2026.

**Which products and versions are affected?** fast-jwt (npm) SEMVER:introduced=0,fixed=6.2.1.

**Is there a fix for CVE-2026-35040?** Yes. fast-jwt (npm): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35040 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35040?** Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.2.1 or later

  ```sh
  npm install fast-jwt@6.2.1
  ```


## Technical details

The vulnerability exists in fast-jwt's validateClaimValues() function, which validates JWT claims using provided matchers. When a RegExp with /g or /y flags is passed as an allowed* option (allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce), the library reuses the same RegExp object across multiple verification calls without resetting its lastIndex property. RegExp.prototype.test() mutates lastIndex when /g or /y flags are set, causing subsequent test() calls on the same object to alternate between matching and failing. An attacker or misconfigured application can exploit this to cause logical denial-of-service: valid, properly signed JWTs are intermittently rejected. The fix, released in version 6.2.1, wraps RegExp matchers to reset lastIndex = 0 before each test() call, restoring deterministic behavior. Applications are only affected if they explicitly use RegExp objects (not strings) with /g or /y flags in allowed* options—most applications using string patterns are unaffected.

## Affected products

- nearform fast-jwt <= 6.1.0

## Identifiers

- CVE-2026-35040
- GHSA-3j8v-cgw4-2g6q

## Timeline

- 2026-04-09: disclosed
- 2026-04-09: patched: Patched in version 6.2.1 (released same day as disclosure)

## References

- [https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q](https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q)
- [https://github.com/nearform/fast-jwt/pull/593](https://github.com/nearform/fast-jwt/pull/593)
- [https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a](https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a)
- [https://github.com/nearform/fast-jwt](https://github.com/nearform/fast-jwt)
- [https://github.com/nearform/fast-jwt/releases/tag/v6.2.1](https://github.com/nearform/fast-jwt/releases/tag/v6.2.1)

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)