CVE-2026-35040

Katalog CVE

CVSS 5.3 · Medium EPSS 0,63%

Kerentanan Expected Behavior Violation pada nearform fast-jwt. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-440: Expected Behavior Violation
CWE-697: Incorrect Comparison

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-3j8v-cgw4-2g6q exploit · mitigasi · advisory vendor
• https://github.com/nearform/fast-jwt/commit/18d25904e4617e8753526d1b3ab5a2cccdea726a patch
• https://github.com/nearform/fast-jwt/pull/593 issue tracking · patch
• https://github.com/nearform/fast-jwt/releases/tag/v6.2.1 product · release notes