CVE-2026-35039 Details
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.
A critical vulnerability exists in fast-jwt versions 0.0.1 prior to 6.1.0, allowing for cache collisions that can misidentify JSON Web Tokens (JWTs) during verification. This issue arises when a custom cacheKeyBuilder method fails to create unique keys for different tokens, leading to valid tokens incorrectly returning claims from others. As a result, users may be misidentified as other users based on the wrong token, potentially allowing for user impersonation, privilege escalation, cross-tenant data access, and authorization bypass.
To address this vulnerability, ensure that custom cacheKeyBuilder methods generate unique keys for each token. Alternatively, remove the custom cacheKeyBuilder and disable caching altogether.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb | [email protected] | Patch |
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nearform fast-jwt | >= 0.1.0, < 6.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |