https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:44:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290253 EUVD-2026-290253 https://cve.radiocsirt.org/vuln/euvd-2026-290253 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35041 <p>fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.</p> <p>fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the supplied RegExp, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, resulting in significant CPU consumption during verification. This vulnerability is fixed in 6.2.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35041 https://cve.radiocsirt.org/vuln/ghsa-cjw9-ghj4-fwxf <p><strong>Affected:</strong> npm: fast-jwt</p> <p>## ⚠️ IMPORTANT CLARIFICATIONS</p> <p>### Affected Configurations This vulnerability ONLY affects applications that: - Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options - Configure patterns susceptible to catastrophic backtracking - Example: `allowedAud: /^(a+)+X$/` ← VULNERABLE - Example: `allowedAud: &#34;api.company.com&#34;` ← SAFE</p> <p>### Not Affected - Applications using string patterns for audience validation (most common) - Applications using safe RegExp patterns without nested quantifiers - Default fast-jwt configurations</p> <p>### Assessment Guide To determine if you&#39;re affected: 1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`) 2. If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc. 3. If no RegExp usage, you are NOT affected</p> <p>------</p> <p>&lt;html&gt; &lt;body&gt; &lt;!--StartFragment--&gt;&lt;h2 data-start=&#34;218&#34; data-end=&#34;228&#34;&gt;Summary&lt;/h2&gt; &lt;p data-start=&#34;230&#34; data-end=&#34;364&#34;&gt;A denial-of-service condition exists in &lt;code data-start=&#34;270&#34; data-end=&#34;280&#34;&gt;fast-jwt&lt;/code&gt; when the &lt;code data-start=&#34;290&#34; data-end=&#34;302&#34;&gt;allowedAud&lt;/code&gt; verification option is configured using a regular expression.&lt;/p&gt; &lt;p data-start=&#34;366&#34; data-end=&#34;618&#34;&gt;Because the &lt;code data-start=&#34;378&#34; data-end=&#34;383&#34;&gt;aud&lt;/code&gt; claim is attacker-controlled and the library evaluates it against the supplied &lt;code data-start=&#34;463&#34; data-end=&#34;471&#34;&gt;RegExp&lt;/code&gt;, a…</p> <p><strong>Affected:</strong> npm: fast-jwt</p> <p>## ⚠️ IMPORTANT CLARIFICATIONS</p> <p>### Affected Configurations This vulnerability ONLY affects applications that: - Use RegExp objects (not strings) in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options - Configure patterns susceptible to catastrophic backtracking - Example: `allowedAud: /^(a+)+X$/` ← VULNERABLE - Example: `allowedAud: &#34;api.company.com&#34;` ← SAFE</p> <p>### Not Affected - Applications using string patterns for audience validation (most common) - Applications using safe RegExp patterns without nested quantifiers - Default fast-jwt configurations</p> <p>### Assessment Guide To determine if you&#39;re affected: 1. Check ifallowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce use RegExp objects (`/pattern/` or `new RegExp()`) 2. If yes, review the pattern for nested quantifiers like `(a+)+`, `(.*)*`, etc. 3. If no RegExp usage, you are NOT affected</p> <p>------</p> <p>&lt;html&gt; &lt;body&gt; &lt;!--StartFragment--&gt;&lt;h2 data-start=&#34;218&#34; data-end=&#34;228&#34;&gt;Summary&lt;/h2&gt; &lt;p data-start=&#34;230&#34; data-end=&#34;364&#34;&gt;A denial-of-service condition exists in &lt;code data-start=&#34;270&#34; data-end=&#34;280&#34;&gt;fast-jwt&lt;/code&gt; when the &lt;code data-start=&#34;290&#34; data-end=&#34;302&#34;&gt;allowedAud&lt;/code&gt; verification option is configured using a regular expression.&lt;/p&gt; &lt;p data-start=&#34;366&#34; data-end=&#34;618&#34;&gt;Because the &lt;code data-start=&#34;378&#34; data-end=&#34;383&#34;&gt;aud&lt;/code&gt; claim is attacker-controlled and the library evaluates it against the supplied &lt;code data-start=&#34;463&#34; data-end=&#34;471&#34;&gt;RegExp&lt;/code&gt;, a…</p> https://cve.radiocsirt.org/vuln/ghsa-cjw9-ghj4-fwxf