CVE-2026-35041

OVERVIEW CVE-2026-35041 affects fast-jwt, a JavaScript library for JSON Web Token processing, in versions 5.0.0 through 6.2.0. The vulnerability exists in the allowedAud verification option when configured with regular expressions. An attacker can craft a malicious JWT with a specially designed aud claim that triggers catastrophic backtracking in the JavaScript regex engine, causing excessive CPU consumption and resulting in denial-of-service conditions. The vulnerability was patched in version 6.2.1. SEVERITY This vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a network-based attack vector requiring low complexity and prior authentication. The impact is limited to availability, with no confidentiality or integrity compromise. The attack requires an authenticated user to submit a crafted token, making opportunistic exploitation less likely than unauthenticated vulnerabilities. However, in environments where fast-jwt is exposed to multiple users or accepts tokens from untrusted sources with authentication mechanisms, the denial-of-service impact could be significant. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's inactive status on the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.0004 reflects the current low likelihood of exploitation. No public exploit code has been reported, and community attention remains minimal given the specific configuration requirement and authentication prerequisite necessary to trigger the flaw.