# CVE-2026-35041: fast-jwt ReDoS in regexp claim validation leading to CPU exhaustion

Source: https://junglewise.ai/threats/cve-2026-35041-fast-jwt-redos-in-regexp-claim-validation-leading-to-cpu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35041 · Severity: medium · CVSS 4.2 · Published 2026-04-09

fast-jwt is a Node.js library used to verify and validate JSON Web Tokens (JWTs) in authentication pipelines. When configured with regular expressions for audience, issuer, subject, or other claim validation, an attacker holding a validly signed JWT can craft malicious claim values that trigger catastrophic regex backtracking, causing verification to consume excessive CPU and block application processing. This impacts authenticated contexts such as API gateways and microservice communication, potentially degrading throughput and increasing costs in serverless environments.

Technologies: [Nearform Fast-Jwt](https://junglewise.ai/threats/technologies/nearform-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Nearform](https://junglewise.ai/threats/vendors/nearform), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-35041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35041 being exploited in the wild.

**How severe is CVE-2026-35041?** Medium severity, with a CVSS score of 4.2, published 9 April 2026.

**Which products and versions are affected?** fast-jwt (npm) SEMVER:introduced=5.0.0,fixed=6.2.1.

**Is there a fix for CVE-2026-35041?** Yes. fast-jwt (npm): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35041 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-35041?** Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.2.1 or later

  ```sh
  npm install fast-jwt@6.2.1
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting fast-jwt versions 5.0.0 through 6.2.0 when claim validation options (allowedAud, allowedIss, allowedSub, allowedJti, allowedNonce) are configured with RegExp objects containing nested quantifiers. An attacker-controlled JWT claim is matched against the supplied pattern without backtracking protection, triggering exponential time complexity. For example, a pattern like /^(a+)+X$/ matched against a string of repeated 'a' characters causes verification time to grow from ~123ms at 24 characters to ~7.85 seconds at 30 characters. Exploitability requires a validly signed JWT and application use of vulnerable regex patterns—not a pre-authentication DoS, but exploitable in authenticated or OAuth/OIDC token validation flows. The fix in version 6.2.1 adds regex safety validation and complexity limits; mitigation guidance recommends string-based patterns instead of RegExp objects.

## Affected products

- NearForm fast-jwt 5.0.0 to 6.2.0

## Identifiers

- CVE-2026-35041
- GHSA-cjw9-ghj4-fwxf

## Timeline

- 2026-04-09: disclosed
- 2026-04-09: patched: Version 6.2.1 released

## References

- [https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf](https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf)

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)