Fasrm

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.

A sandbox boundary violation allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the `.then()` callback preserves host identity. This occurs because the Promise fulfillment wrapper uses the `ensureThis()` function instead of a stronger cross-realm conversion path. If no prototype mapping is found, `ensureThis()` returns the original object, allowing the sandbox to interact with the host object directly. This enables performing identity checks using host-side `WeakMap` and mutating host object state from inside the sandbox.

Name of the Vulnerable Software and Affected Versions: fast-jwt versions 5.0.0 through 6.2.0 Description: fast-jwt is susceptible to a denial-of-service condition when the `allowedAud` verification option is configured using a regular expression. Because the `aud` claim is attacker-controlled and evaluated against the supplied `RegExp`, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, leading to significant CPU consumption during verification. This can impact API gateways, authentication middleware, service-to-service communication, and OAuth / OIDC token validation pipelines. The vulnerability occurs with a validly signed JWT, making it exploitable in authenticated contexts. The issue is due to the library allowing regular expressions in claim validation and the attacker's ability to control the `aud` claim, resulting in exponential verification time growth as input length increases. This can block Node.js event loop threads, degrade API throughput, cause cascading service failures, increase serverless execution costs, and saturate authentication infrastructure. Recommendations: For versions 5.0.0 through 6.2.0, avoid using regular expressions in the `allowedAud`, `allowedIss`, `allowedSub`, `allowedJti`, or `allowedNonce` options. If regular expressions are necessary, ensure they are safe and do not contain nested quantifiers that could lead to catastrophic backtracking.

Name of the Vulnerable Software and Affected Versions fast-jwt (affected versions not specified) Description The `fast-jwt` library has a cache confusion vulnerability that can lead to identity or authorization mix-ups. This occurs when a custom `cacheKeyBuilder` function does not create unique keys for different tokens, leading to cache collisions. This can result in valid tokens returning claims from different tokens, user impersonation, privilege escalation, cross-tenant data access, and authorization bypass. The vulnerability only affects applications that enable caching and use custom `cacheKeyBuilder` functions prone to collisions. Examples of vulnerable configurations include those that group by audience, user type, or tenant and service. Safe configurations include using the default hash-based caching or disabling caching altogether. The `parseToken` function is used within the `cacheKeyBuilder` function. Recommendations Ensure uniqueness of keys produced in the `cacheKeyBuilder` function. Remove the custom `cacheKeyBuilder` function. Disable caching.