# CVE-2026-35039: fast-jwt cacheKeyBuilder collision identity mixup

Source: https://junglewise.ai/threats/cve-2026-35039-fast-jwt-cachekeybuilder-collision-identity-mixup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35039 · Severity: critical · CVSS 9.1 · Published 2026-04-06

fast-jwt is a Node.js library for signing and verifying JSON Web Tokens (JWTs), commonly used in authentication systems to verify user identity. When caching is enabled with a poorly-designed custom cache key builder, two different users' tokens can incorrectly map to the same cache entry, causing the library to return one user's identity/permissions when verifying another user's token. This can lead to user impersonation, privilege escalation, or unauthorized data access across tenants.

Technologies: [Nearform Fast-Jwt](https://junglewise.ai/threats/technologies/nearform-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Nearform](https://junglewise.ai/threats/vendors/nearform), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-35039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35039 being exploited in the wild.

**How severe is CVE-2026-35039?** Critical severity, with a CVSS score of 9.1, published 6 April 2026.

**Which products and versions are affected?** fast-jwt (npm) SEMVER:introduced=0.0.1,fixed=6.2.0.

**Is there a fix for CVE-2026-35039?** Yes. fast-jwt (npm): upgrade to 6.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35039 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-35039?** Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-jwt (npm): upgrade to 6.2.0 or later

  ```sh
  npm install fast-jwt@6.2.0
  ```


## Technical details

The vulnerability is a cache collision issue in the verifier's cacheKeyBuilder mechanism (src/verifier.js). When caching is enabled and a developer supplies a custom cacheKeyBuilder that produces non-unique keys for different tokens, the verifier returns the cached payload of a previously-verified token instead of validating and returning the current token's payload. For example, if two tokens for different users (userA and userB) both produce the cache key "aud=admin", verifying userB's token will return userA's cached claims. The vulnerability requires both caching to be explicitly enabled and a custom cacheKeyBuilder to be configured; the default caching behavior uses secure hashing and is not affected. No authentication bypass is required—attackers only need to submit valid JWTs with payloads that collide on the cache key.

## Affected products

- nearform fast-jwt 0.0.1 to 6.1.0 (patched in 6.2.0)

## Identifiers

- CVE-2026-35039
- GHSA-rp9m-7r4c-75qg

## Timeline

- 2026-04-03: disclosed
- 2026-04-03: patched: Patch released in version 6.2.0, though library maintainers note this is primarily an education/warning update as the vulnerability stems from developer misuse of the API

## References

- [https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg](https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg)

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)