EUVD-2026-318076

fkie_cve-2026-35039

fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version 6.2.0 contains a patch.

GHSA-rp9m-7r4c-75qg — fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorizati…

Affected: npm: fast-jwt

_NOTE_: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users around the possible issues however since the defaults work we will not be updating the library beyond that for this advisory.

## Impact

Setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to:

- Valid tokens returning claims from different valid tokens - Users being mis-identified as other users based on the wrong token

This could result in: - User impersonation - UserB receives UserA's identity and permissions - Privilege escalation - Low-privilege users inherit admin-level access - Cross-tenant data access - Users gain access to other tenants' resources - Authorization bypass - Security decisions made on wrong user identity

## Affected Configurations

This vulnerability ONLY affects applications that BOTH:

1. Enable caching using the cache option 2. Use custom cacheKeyBuilder functions that can produce collisions

VULNERABLE examples: ``` // Collision-prone: same audience = same cache key cacheKeyBuilder: (token) => { const { aud } = parseToken(token) return `aud=${aud}` }

// Collision-prone: grouping by user type cacheKeyBuilder: (token) => { const { aud } = parseToken(token) r…

Most recent entries from all

EUVD-2026-318076

fkie_cve-2026-35039

GHSA-rp9m-7r4c-75qg — fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorizati…