AIKIDO-2026-570627

TL;DR

jwcrypto validates a JWK's key_ops list during import by checking each entry against every other entry for duplicates, and separately checks use/key_ops consistency with nested list scans. A JWK with a large or heavily duplicated key_ops array drives this validation into quadratic-time comparisons, so importing a single malformed key can consume disproportionate CPU. The fix replaces the nested duplicate check with a length bound and a set-based comparison, and matches use against key_ops with a single lookup table.