fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94 Patch
- https://github.com/nearform/fast-jwt/pull/595 Issue Tracking, Patch
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf Exploit, Mitigation, Vendor Advisory
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · nearformNVD modified 2026-10-26 22:10
Affected (CPE criteria) 1
cpe:2.3:a:nearform:fast-jwt:*:*:*:*:*:node.js:*:*
References 5
- https://github.com/nearform/fast-jwt/commit/b0be0ca161593836a153d5180ca5358ad9b5de94 Patch
- https://github.com/nearform/fast-jwt/pull/595 Issue Tracking, Patch
- https://github.com/nearform/fast-jwt/releases/tag/v6.2.1 Product, Release Notes
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf Exploit, Mitigation, Vendor Advisory
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf Exploit, Mitigation, Vendor Advisory