Is CVE-2026-35039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35039 being exploited in the wild.

How severe is CVE-2026-35039?

Critical severity, with a CVSS score of 9.1, published 6 April 2026.

Which products and versions are affected?

fast-jwt (npm) SEMVER:introduced=0.0.1,fixed=6.2.0.

Is there a fix for CVE-2026-35039?

Yes. fast-jwt (npm): upgrade to 6.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35039 attacked?

It is attacked over the network.

Am I affected by CVE-2026-35039?

Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35039: fast-jwt cacheKeyBuilder collision identity mixup

CVE-2026-35039 · Severity: critical · CVSS 9.1 · Published 2026-04-06

fast-jwt is a Node.js library for signing and verifying JSON Web Tokens (JWTs), commonly used in authentication systems to verify user identity. When caching is enabled with a poorly-designed custom cache key builder, two different users' tokens can incorrectly map to the same cache entry, causing the library to return one user's identity/permissions when verifying another user's token. This can lead to user impersonation, privilege escalation, or unauthorized data access across tenants.

Technologies: Nearform Fast-Jwt, fast-jwt (npm). Vendors: Nearform, npm.

Quick answers

Is CVE-2026-35039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35039 being exploited in the wild.
How severe is CVE-2026-35039?: Critical severity, with a CVSS score of 9.1, published 6 April 2026.
Which products and versions are affected?: fast-jwt (npm) SEMVER:introduced=0.0.1,fixed=6.2.0.
Is there a fix for CVE-2026-35039?: Yes. fast-jwt (npm): upgrade to 6.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35039 attacked?: It is attacked over the network.
Am I affected by CVE-2026-35039?: Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-jwt (npm): upgrade to 6.2.0 or later
```
npm install fast-jwt@6.2.0
```

Technical details

The vulnerability is a cache collision issue in the verifier's cacheKeyBuilder mechanism (src/verifier.js). When caching is enabled and a developer supplies a custom cacheKeyBuilder that produces non-unique keys for different tokens, the verifier returns the cached payload of a previously-verified token instead of validating and returning the current token's payload. For example, if two tokens for different users (userA and userB) both produce the cache key "aud=admin", verifying userB's token will return userA's cached claims. The vulnerability requires both caching to be explicitly enabled and a custom cacheKeyBuilder to be configured; the default caching behavior uses secure hashing and is not affected. No authentication bypass is required—attackers only need to submit valid JWTs with payloads that collide on the cache key.

Affected products

nearform fast-jwt 0.0.1 to 6.1.0 (patched in 6.2.0)

Identifiers

CVE-2026-35039
GHSA-rp9m-7r4c-75qg

Timeline

2026-04-03: disclosed
2026-04-03: patched: Patch released in version 6.2.0, though library maintainers note this is primarily an education/warning update as the vulnerability stems from developer misuse of the API

References

https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.