CVEvulnerability

CVE-2026-35039

9.1 CRITICAL Published 2026-04-06 Modified 2026-10-23 Official page ↗
Status
Analyzed
Published
2026-04-06
Last modified
2026-10-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1289, CWE-345, CWE-706

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.

Affected configurations

• nearform fast-jwt (>= 0.1.0 < 6.1.0)

Related

Weakness · CWE (3)

  • CWE-1289 Improper Validation of Unsafe Equivalence in Input weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness

References