CVE-2026-35039 fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Improper cache key generation in fast-jwt allows token verification to return claims from different tokens, enabling user impersonation and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35039?
CVE-2026-35039 is a critical authentication bypass vulnerability in nearform fast-jwt, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.
Which versions are affected by CVE-2026-35039?
2 open source packages ship an affected version, including fast-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-jwt npm | From 0.0.1 | 6.2.0 |
fast-jwt npm | From 0.0.1 | 6.2.0 |
Products include Nearform Fast-Jwt.
How do I fix CVE-2026-35039?
Upgrade fast-jwt to 6.2.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-35039 being exploited?
There is no known exploitation of CVE-2026-35039 in the wild and no public exploit code.
Other vulnerabilities in nearform fast-jwt
- CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
- CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2023-48223 fast-jwt JWT Algorithm Confusion
- CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
- CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Sources
Also known as GHSA-rp9m-7r4c-75qg.