Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ctxb-wxf9-zuh3
Vulnerability ID VCID-ctxb-wxf9-zuh3
Aliases CVE-2026-35040
GHSA-3j8v-cgw4-2g6q
Summary fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-440 Expected Behavior Violation
CWE-697 Incorrect Comparison
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2026-35040
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2026-35040
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3j8v-cgw4-2g6q
cvssv3.1 5.3 https://github.com/nearform/fast-jwt
generic_textual MODERATE https://github.com/nearform/fast-jwt
cvssv3.1 5.3 https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
generic_textual MODERATE https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
ssvc Track https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
cvssv3.1 5.3 https://github.com/nearform/fast-jwt/pull/593
generic_textual MODERATE https://github.com/nearform/fast-jwt/pull/593
ssvc Track https://github.com/nearform/fast-jwt/pull/593
cvssv3.1 5.3 https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
generic_textual MODERATE https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
ssvc Track https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
cvssv3.1 5.3 https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
cvssv3.1_qr MODERATE https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
generic_textual MODERATE https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
ssvc Track https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-35040
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-35040
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35040
https://github.com/nearform/fast-jwt
https://nvd.nist.gov/vuln/detail/CVE-2026-35040
18d25904e4617e8753526d1b3ab5a2cccdea726a https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
593 https://github.com/nearform/fast-jwt/pull/593
GHSA-3j8v-cgw4-2g6q https://github.com/advisories/GHSA-3j8v-cgw4-2g6q
GHSA-3j8v-cgw4-2g6q https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
v6.2.1 https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nearform/fast-jwt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-13T20:03:24Z/ Found at https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nearform/fast-jwt/pull/593
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-13T20:03:24Z/ Found at https://github.com/nearform/fast-jwt/pull/593
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-13T20:03:24Z/ Found at https://github.com/nearform/fast-jwt/releases/tag/v6.2.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-13T20:03:24Z/ Found at https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35040
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.39773
EPSS Score 0.00182
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:52.322690+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35040.json 38.6.0