VulnerabilityAnalyzed

CVE-2026-35039

fast-jwt provides fast JSON Web Token (JWT) implementation.

CRITICAL 9.1EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-345, CWE-706, CWE-1289
Affected: nearform/fast-jwt
Source: security-advisories@github.com

References

https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4cebPatch
https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qgMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.