Vulnerability in Nearform Fast-jwt
CVE-2026-35040
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unin…
EPSS: 0.002 (39.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Nearform Fast-jwt — versions < 6.2.1
Weakness classification (CWE)
References
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q (x_refsource_CONFIRM)
- https://github.com/nearform/fast-jwt/pull/593 (x_refsource_MISC)
- https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a (x_refsource_MISC)
- https://github.com/nearform/fast-jwt/releases/tag/v6.2.1 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-35040?
- CVE-2026-35040 is a medium-severity vulnerability in Nearform Fast-jwt, classified under Incorrect Comparison. CVSS score: 5.3/10. Published 2026-04-09.
- How severe is CVE-2026-35040?
- Medium severity. CVSS v3 base score is 5.3 out of 10.