For your first problem, route handling always goes by regex sequence so place /challenges/current first and then keep /challenges/:id, so that the control comes to :id route only if it fails for current regex match.
For second problem, JWT and REST are not related conceptually so expecting userId in JWT is for your logic and expecting :id in the route is the REST standard so expect both and before you proceed with the actual logic with JWT inside middleware, first you verify if user-id passed inside JWT and route are same otherwise you respond with 403-forbidden access.