A denial‑of‑service condition exists in the fast‑jwt library when the allowedAud verification option is configured with a regular expression. Attacker‑controlled JSON Web Token claim values are evaluated against the supplied RegExp, and a carefully crafted token can trigger catastrophic backtracking in the JavaScript regex engine. This results in elevated CPU consumption during verification, effectively exhausting server resources. The weakness is a classic Regular Expression Backtracking issue (CWE‑1333).

The vulnerability affects the nearform Fast‑jwt library for Node.js. Versions from 5.0.0 through 6.2.0 are impacted. The issue is fixed in release 6.2.1 and later.

The CVSS score is 4.2, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation in the wild at present. However, once a malicious JWT is presented to an application using this library with a RegExp allowedAud configuration, the backtracking can be triggered, which may allow an attacker to cause out‑of‑band denial of service. The vulnerability is not listed in the CISA KEV catalog, but care should be taken as it can be exploited remotely via the application’s authentication endpoint.