How severe is CVE-2026-35040?

CVE-2026-35040 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-35040 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-35040?

CVE-2026-35040 affects Nearform Fast-jwt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-35040?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-35040 have an EU (EUVD) identifier?

Yes. CVE-2026-35040 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-20898.

When was CVE-2026-35040 published?

CVE-2026-35040 was published on 2026-04-09 and last updated on 2026-06-17.

CVE-2026-35040

CVE-2026-35040 is a medium-severity vulnerability in Nearform Fast-jwt with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-440.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (30th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-20898
Weakness: CWE-440
Affected product: Nearform Fast-jwt
Published: 2026-04-09
Last modified: 2026-06-17

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.

Frequently asked questions

What is CVE-2026-35040?: fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.
How severe is CVE-2026-35040?: CVE-2026-35040 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-35040 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-35040?: CVE-2026-35040 affects Nearform Fast-jwt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-35040?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-35040 have an EU (EUVD) identifier?: Yes. CVE-2026-35040 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-20898.
When was CVE-2026-35040 published?: CVE-2026-35040 was published on 2026-04-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nearform:fast-jwt:*:*:*:*:*:node.js:*:*

More vulnerabilities in Nearform Fast-jwt

CVE-2026-35039 — Critical (CVSS 9.1): fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom…
CVE-2026-34950 — Critical (CVSS 9.1): fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in…
CVE-2026-35042 — High (CVSS 7.5): fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit…
CVE-2023-48223 — Medium (CVSS 5.9): fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not…
CVE-2026-35041 — Medium (CVSS 4.2): fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists…

All CVEs affecting Nearform Fast-jwt →

Other CWE-440 vulnerabilities

CVE-2019-6569 — Critical (CVSS 9.1): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into…
CVE-2024-32971 — Critical (CVSS 9.0): Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation…
CVE-2025-8850 — High (CVSS 8.8): In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA)…
CVE-2026-8806 — High (CVSS 8.7): Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module…
CVE-2018-12550 — High (CVSS 8.1): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty,…
CVE-2023-4807 — High (CVSS 7.8): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the…

Browse all CWE-440 vulnerabilities →