A stateful RegExp modifier applied to claims such as allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce causes every second verification attempt to fail, even when the token is valid. The effect is a logical denial‑of‑service in authentication, where 50% of legitimate requests are rejected with no unauthorized access or data breach.

The issue is present in the nearform fast‑jwt library, affecting all releases prior to version 6.2.1. The defect was addressed in the 6.2.1 release and later. Applications that depend on fast‑jwt for JWT validation and that use RegExp modifiers /g or /y in the claim‑validation options are impacted.

The CVSS score of 5.3 reflects moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker who can influence the verification call (for example by controlling the RegExp flags in the payload or by submitting crafted tokens to an authentication endpoint) would cause intermittent authentication failures, potentially degrading service availability. Direct exploitation does not lead to privilege escalation or data disclosure.