Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35041 Denial-of-Service via Regex Catastrophic Backtracking in fast-jwt 5.0.0-6.2.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35041
Post summary
The post announces CVE-2026-35041 as a DoS vulnerability caused by regex backtracking in fast‑jwt (5.0.0‑6.2.0), providing affected versions but no PoC or exploit details.
CVE-2026-35041 fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification opt… https://www.cve.org/CVERecord?id=CVE-2026-35041
Post summary
CVE‑2026‑35041 reports a denial‑of‑service vulnerability in fast‑jwt for versions 5.0.0–6.2.0; no PoC, exploit, patch, or active exploitation details are included.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nearform | fast-jwt | - | node.js | - |