CVE-2026-35040
1 advisory.
npm/fast-jwt CVE-2026-35040: medium 5.3
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Action: Upgrade fast-jwt to 6.2.1 or later.
npm i fast-jwt@6.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.2.1 | - |
Fixed versions
| 6.2.1 |
Sources
- osv: GHSA-3j8v-cgw4-2g6q
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-35040
- https://github.com/nearform/fast-jwt/pull/593
- https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
- https://github.com/nearform/fast-jwt
- https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
CVE-2026-35040 · published · modified · JSON