fix: recognise RegExp matchers created in another realm

The allowed* verifier options gated their RegExp handling on
`r instanceof RegExp`, which is a prototype-chain identity check rather
than a type check. A RegExp built in a different JavaScript realm, for
example via `vm.runInNewContext`, fails it despite being a fully
functional RegExp with a live lastIndex.

Such a matcher fell through to the duck-typed `test()` branch and was
stored raw, so a cross-realm /g or /y pattern reintroduced the
non-determinism the lastIndex reset (CVE-2026-35040) fixed: a valid
token alternated between accepted and rejected across successive calls.
The same gap silently skipped the FAST_JWT_UNSAFE_REGEXP ReDoS warning
for a cross-realm pattern.

Both call sites now share an `isRegExpLike()` helper. `isRegExp` from
node:util inspects the engine's internal slot, so it is realm
independent; the `instanceof` arm is kept so objects presenting as
RegExps without the internal slot keep the handling they had before.
`Object.prototype.toString.call()` was avoided because its brand can be
forged through Symbol.toStringTag.

Widening the predicate brings real cross-realm RegExps into the reset
path for the first time, where an unconditional `lastIndex` write throws
for a frozen matcher. The write is now wrapped so an unwritable matcher
falls through to test() instead, which also fixes frozen same-realm
RegExps that threw on every call before.

A Proxy over a cross-realm /g RegExp remains non-deterministic: it
satisfies neither isRegExp nor instanceof RegExp, so it is treated as a
custom matcher. That is pre-existing behaviour and out of scope here.

Closes #654

Author: SociableSteve

README.md

@@ -164,6 +164,8 @@ Create a verifier function by calling `createVerifier` and providing one or more
 
 - `allowedNonce`: A string, a regular expression, an array of strings or an array of regular expressions containing allowed values for the nonce claim (`nonce`). By default, all values are accepted.
 
+For the five `allowed*` options above, any object exposing a `test(value)` method happens to work at runtime in plain JavaScript, but it is not part of the TypeScript types and is not a supported configuration. fast-jwt resets a `RegExp` matcher's `lastIndex` before each test, so a stateful pattern validates deterministically, but it performs no state management on a custom matcher's behalf, so a stateful custom matcher is the caller's responsibility.
+
 - `requiredClaims`: An array of strings containing which claims should exist in the token. By default, no claim is marked as required.
 
 - `ignoreExpiration`: Do not validate the expiration of the token. Default is `false`.

src/verifier.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const { createPublicKey, createSecretKey } = require('node:crypto')
+const { isRegExp } = require('node:util').types
 const Cache = require('mnemonist/lru-cache')
 
 const safeRegex = require('safe-regex2')
@@ -42,10 +43,14 @@ function prepareKeyOrSecret(key, isSecret) {
   return isSecret ? createSecretKey(key) : createPublicKey(key)
 }
 
+function isRegExpLike(value) {
+  return isRegExp(value) || value instanceof RegExp
+}
+
 function checkForUnsafeRegExp(raw, optionName) {
   const patterns = Array.isArray(raw) ? raw : [raw]
   for (const r of patterns) {
-    if (r instanceof RegExp && !safeRegex(r)) {
+    if (isRegExpLike(r) && !safeRegex(r)) {
       process.emitWarning(
         `The ${optionName} option contains an unsafe RegExp ${r} that may cause a ReDoS attack. Please review it. ` +
           'See https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf for details.',
@@ -63,10 +68,14 @@ function ensureStringClaimMatcher(raw) {
   return raw
     .filter(r => r)
     .map(r => {
-      if (r instanceof RegExp) {
+      if (isRegExpLike(r)) {
         return {
           test: v => {
-            r.lastIndex = 0
+            try {
+              r.lastIndex = 0
+            } catch {
+              // A frozen matcher cannot be reset, so let test() decide rather than throwing.
+            }
             return r.test(v)
           }
         }

test/verifier.spec.js

@@ -4,6 +4,7 @@ const { createHash, createHmac } = require('node:crypto')
 const { readFileSync } = require('node:fs')
 const { resolve } = require('node:path')
 const { describe, test } = require('node:test')
+const vm = require('node:vm')
 
 const { createSigner, createVerifier, TokenError } = require('../src')
 const { hashToken } = require('../src/utils')
@@ -2120,6 +2121,243 @@ describe('createVerifier', () => {
     })
   })
 
+  describe('cross-realm and duck-typed RegExp matchers', () => {
+    test('cross-realm /g flag must not cause non-deterministic claim validation - allowedAud', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const crossRealmRegExp = vm.runInNewContext('/^admin$/g')
+      const verifier = createVerifier({ key: 'secret', allowedAud: crossRealmRegExp })
+
+      // All 8 successive calls with the same valid token must succeed
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass with a cross-realm /g RegExp`)
+      }
+    })
+
+    test('cross-realm /g flag must not cause non-deterministic claim validation - allowedIss', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ iss: 'issuer' })
+      const crossRealmRegExp = vm.runInNewContext('/^issuer$/g')
+      const verifier = createVerifier({ key: 'secret', allowedIss: crossRealmRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass with a cross-realm /g RegExp`)
+      }
+    })
+
+    test('a cross-realm RegExp that does not match the claim keeps rejecting across successive calls', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'guest' })
+      const crossRealmRegExp = vm.runInNewContext('/^admin$/g')
+      const verifier = createVerifier({ key: 'secret', allowedAud: crossRealmRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.throws(() => verifier(encodedToken), TokenError, `call ${attempt} should reject a non-matching aud`)
+      }
+    })
+
+    test('emits FAST_JWT_UNSAFE_REGEXP warning for an unsafe cross-realm RegExp in allowedAud', async t => {
+      const crossRealmRegExp = vm.runInNewContext('/^(a+)+X$/')
+      const w = await expectWarning('FAST_JWT_UNSAFE_REGEXP', () =>
+        createVerifier({ key: 'secret', allowedAud: crossRealmRegExp })
+      )
+      t.assert.equal(w.code, 'FAST_JWT_UNSAFE_REGEXP')
+      t.assert.ok(w.message.includes('allowedAud'))
+    })
+
+    test('a plain duck-typed matcher object is used as-is', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const customMatcher = {
+        test(value) {
+          return value === 'admin'
+        }
+      }
+      const verifier = createVerifier({ key: 'secret', allowedAud: customMatcher })
+
+      t.assert.doesNotThrow(() => verifier(encodedToken))
+
+      const rejectingToken = sign({ aud: 'guest' })
+      t.assert.throws(() => verifier(rejectingToken), TokenError)
+    })
+
+    test('an array mixing a cross-realm /g RegExp with a plain string behaves deterministically', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const crossRealmRegExp = vm.runInNewContext('/^admin$/g')
+      const verifier = createVerifier({ key: 'secret', allowedAud: [crossRealmRegExp, 'other-audience'] })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(
+          () => verifier(encodedToken),
+          `call ${attempt} should pass with a cross-realm /g RegExp in an array`
+        )
+      }
+    })
+
+    test('a method-binding Proxy over a /g RegExp validates deterministically', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const bindingHandler = {
+        get(target, property) {
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        }
+      }
+      const proxiedRegExp = new Proxy(/^admin$/g, bindingHandler)
+      const verifier = createVerifier({ key: 'secret', allowedAud: proxiedRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(
+          () => verifier(encodedToken),
+          `call ${attempt} should pass with a method-binding Proxy over a /g RegExp`
+        )
+      }
+    })
+
+    // The throw here comes from safe-regex2 stringifying the matcher, not from a check fast-jwt makes,
+    // so a safe-regex2 change could move the failure without fast-jwt changing.
+    test('a Proxy-wrapped RegExp matcher fails at createVerifier() time, not on each verify() call', t => {
+      const proxiedRegExp = new Proxy(/^admin$/, {})
+
+      t.assert.throws(() => createVerifier({ key: 'secret', allowedAud: proxiedRegExp }), TypeError)
+    })
+
+    test('a frozen cross-realm RegExp without a stateful flag validates without throwing', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const frozenCrossRealmRegExp = Object.freeze(vm.runInNewContext('/^admin$/'))
+      const verifier = createVerifier({ key: 'secret', allowedAud: frozenCrossRealmRegExp })
+
+      for (let attempt = 0; attempt < 4; attempt++) {
+        t.assert.doesNotThrow(
+          () => verifier(encodedToken),
+          `call ${attempt} should pass with a frozen cross-realm RegExp`
+        )
+      }
+    })
+
+    test('a matcher whose lastIndex cannot be written never throws a TypeError', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const refusingHandler = {
+        get(target, property) {
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        },
+        set() {
+          throw new TypeError('lastIndex write refused')
+        }
+      }
+      const proxiedRegExp = new Proxy(/^admin$/g, refusingHandler)
+      const verifier = createVerifier({ key: 'secret', allowedAud: proxiedRegExp })
+
+      // The claim may or may not match, since a lastIndex we cannot reset stays advanced, but the
+      // failure must always be a TokenError rather than the raw TypeError earlier versions threw.
+      for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+          verifier(encodedToken)
+        } catch (error) {
+          t.assert.ok(error instanceof TokenError, `call ${attempt} should not throw a TypeError`)
+        }
+      }
+    })
+
+    test('a stateful matcher whose flag getters throw still validates deterministically', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const throwingFlagHandler = {
+        get(target, property) {
+          if (property === 'global' || property === 'sticky') {
+            throw new TypeError('flag access refused')
+          }
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        }
+      }
+      const proxiedRegExp = new Proxy(/^admin$/g, throwingFlagHandler)
+      const verifier = createVerifier({ key: 'secret', allowedAud: proxiedRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass when flag getters throw`)
+      }
+    })
+
+    test('a /g RegExp that reports global as false is still reset between calls', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const lyingRegExp = /^admin$/g
+      Object.defineProperty(lyingRegExp, 'global', { value: false })
+      const verifier = createVerifier({ key: 'secret', allowedAud: lyingRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass despite a false global flag`)
+      }
+    })
+
+    test('a non-global RegExp subclass whose exec advances lastIndex is still reset between calls', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      // exec() both advances and depends on lastIndex, so it only matches when lastIndex was reset.
+      class AdvancingRegExp extends RegExp {
+        exec(input) {
+          this.lastIndex += 1
+          return this.lastIndex === 1 ? [input] : null
+        }
+      }
+      const advancingRegExp = new AdvancingRegExp('^admin$')
+      const verifier = createVerifier({ key: 'secret', allowedAud: advancingRegExp })
+
+      for (let attempt = 0; attempt < 8; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass with an advancing subclass`)
+      }
+    })
+
+    test('a matcher whose flag getters throw still validates instead of throwing', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const throwingFlagHandler = {
+        get(target, property) {
+          if (property === 'global' || property === 'sticky') {
+            throw new TypeError('flag access refused')
+          }
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        }
+      }
+      const proxiedRegExp = new Proxy(/^admin$/, throwingFlagHandler)
+      const verifier = createVerifier({ key: 'secret', allowedAud: proxiedRegExp })
+
+      for (let attempt = 0; attempt < 4; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass when flag getters throw`)
+      }
+    })
+
+    test('a frozen same-realm RegExp without a stateful flag validates without throwing', t => {
+      t.mock.timers.enable({ now: 100000 })
+      const sign = createSigner({ key: 'secret' })
+      const encodedToken = sign({ aud: 'admin' })
+      const frozenRegExp = Object.freeze(/^admin$/)
+      const verifier = createVerifier({ key: 'secret', allowedAud: frozenRegExp })
+
+      for (let attempt = 0; attempt < 4; attempt++) {
+        t.assert.doesNotThrow(() => verifier(encodedToken), `call ${attempt} should pass with a frozen RegExp`)
+      }
+    })
+  })
+
   describe('crit header validation (RFC 7515 §4.1.11)', () => {
     test('rejects token with unknown critical extension (secure-by-default, no allowedCritHeaders)', t => {
       const signer = createSigner({