CVE-2026-35041: fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification

⚠️ IMPORTANT CLARIFICATIONS

Affected Configurations

This vulnerability ONLY affects applications that:

• Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options
• Configure patterns susceptible to catastrophic backtracking
• Example: allowedAud: /^(a+)+X$/ ← VULNERABLE
• Example: allowedAud: "api.company.com" ← SAFE

Not Affected

• Applications using string patterns for audience validation (most common)
• Applications using safe RegExp patterns without nested quantifiers
• Default fast-jwt configurations

Assessment Guide

To determine if you’re affected:

1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (/pattern/ or new RegExp())
2. If yes, review the pattern for nested quantifiers like (a+)+, (.*)*, etc.
3. If no RegExp usage, you are NOT affected