Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-03 | 2 | Disclosure1Patch1 |
| 2026-04-06 | 3 | Disclosure2Patch1 |
CVE-2026-35039 fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.1.0, setting up a custom cacheKeyBuilder method which does not properly create uniq… https://www.cve.org/CVERecord?id=CVE-2026-35039
Post summary
The tweet announces CVE‑2026‑35039 affecting the fast-jwt library, referencing a flaw in the custom cacheKeyBuilder method, but provides no PoC, exploit, or patch details.
[CVE-2026-35039: CRITICAL] Ensure your cyber security with fast-jwt's improved JWT implementation. Avoid cache collision risks by setting up unique cacheKeys for tokens after 6.1.0. Stay protected!#cve,CVE-2026-35039,#cybersecurity https://cvefind.com/CVE-2026-35039
Post summary
The tweet highlights a critical vulnerability in fast-jwt’s JWT implementation, advises setting unique cacheKeys beginning with version 6.1.0 to mitigate cache collision risks, and effectively promotes a workaround.
🚨 CVE-2026-35039: fast-jwt Affected by Cache Confu... Cache key collisions in fast-jwt's custom cacheKeyBuilder can swap user identities - authentication bypass meets privil... https://zerodaysignal.com/vulnerability/CVE-2026-35039 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a cache key collision vulnerability in fast-jwt that permits identity swapping and privilege escalation, without mention of active exploitation or mitigation.
The `fast-jwt` library has a cache confusion vulnerability (CVE-2026-35039) leading to identity/authorization mixup. Review `cacheKeyBuilder` configurations. #jwt #security #nodejs https://www.pulsepatch.io/posts/cve-2026-35039-fast-jwt-cache-confusion
Post summary
The post announces CVE-2026-35039, a cache confusion flaw in the fast-jwt library that can cause identity and authorization mix‑ups, and recommends reviewing cacheKeyBuilder settings.
🚨 Critical fast-jwt flaw: CVE-2026-35039 An improper caching issue could put applications at serious risk. Update now or apply the recommended workaround. 🔗 https://vulert.com/vuln-db/CVE-2026-35039 #CyberSecurity #fastjwt #CVE202635039 #Vulert https://t.co/RGeNLaDbfx
Post summary
The tweet announces a critical fast-jwt flaw (CVE‑2026‑35039), warns that an improper caching issue could be exploited, and urges users to update or apply a recommended workaround.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nearform | fast-jwt | - | node.js | - |