CVE-2026-35039CWE-1289CWE-345CWE-706

CVE-2026-35039

Critical · published April 6, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.7th percentile
Weaknesses
CWE-1289 · Improper Validation of Unsafe Equivalence in Input; CWE-345 · Insufficient Verification of Data Authenticity; CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-04-06T21:17Z
Affected products (1)
ProductVersionsFixed in
nearform/fast-jwt≥ 0.1.0, < 6.1.06.1.0
References (2)
https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb · [email protected]https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg · [email protected]
EPSS history
Timeline
  • 06 APR 16:59Z
    fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
    cvelistv5