Executive brief
fast-jwt is a Node.js library used to verify and validate JSON Web Tokens (JWTs) in authentication pipelines. When configured with regular expressions for audience, issuer, subject, or other claim validation, an attacker holding a validly signed JWT can craft malicious claim values that trigger catastrophic regex backtracking, causing verification to consume excessive CPU and block application processing. This impacts authenticated contexts such as API gateways and microservice communication, potentially degrading throughput and increasing costs in serverless environments.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting fast-jwt versions 5.0.0 through 6.2.0 when claim validation options (allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce) are configured with RegExp objects containing nested quantifiers. An attacker-controlled JWT claim is matched against the supplied pattern without backtracking protection, triggering exponential time complexity. For example, a pattern like /^(a+)+X$/ matched against a string of repeated 'a' characters causes verification time to grow from ~123ms at 24 characters to ~7.85 seconds at 30 characters. Exploitability requires a validly signed JWT and application use of vulnerable regex patterns—not a pre-authentication DoS, but exploitable in authenticated or OAuth/OIDC token validation flows. The fix in version 6.2.1 adds regex safety validation and complexity limits; mitigation guidance recommends string-based patterns instead of RegExp objects.
Affected products
- NearForm fast-jwt 5.0.0 to 6.2.0
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Version 6.2.1 released