CVE-2026-35039: fast-jwt Cache Confusion Vulnerability Leading to Identity and Authorization Issues
Summary
CVE-2026-35039: Impact Setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. Affects fast-jwt versions >= 0.0.1, < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-jwt is a popular JavaScript library used for creating and verifying JSON Web Tokens (JWTs). It provides a simple and efficient way to handle authentication and authorization in web applications. However, its caching mechanism can be exploited if not configured correctly, leading to serious security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the improper implementation of the cacheKeyBuilder function, which can produce non-unique keys for different tokens. This can lead to cache collisions, where valid tokens return claims from other tokens, resulting in user impersonation, privilege escalation, cross-tenant data access, and authorization bypass. The issue is particularly critical for applications that enable caching and use custom cacheKeyBuilder functions that can generate identical keys for different users or tokens.
How To Fix
Latest published version: 6.3.5 as of 22 Oct 2026
npm install fast-jwt@6.3.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.1.0
This is the first release that contains the fix.
npm install fast-jwt@6.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider removing the custom cacheKeyBuilder function or disabling caching altogether. Here are some examples of safe cacheKeyBuilder implementations:
// Default hash-based (recommended)
createVerifier({ cache: true });
// Uses secure default
// Include unique user identifier
cacheKeyBuilder: (token) => {
const { sub, aud, iat } = parseToken(token);
return `${sub}-${aud}-${iat}`;
}
// No caching (always safe)
createVerifier({ cache: false });
Conclusion
The fast-jwt package has a critical vulnerability (CVE-2026-35039) that can lead to severe security issues due to improper caching mechanisms. It is essential to update to the patched version or implement workarounds to ensure the security of your application.
See every vulnerability recorded for fast-jwt →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include user impersonation, privilege escalation, cross-tenant data access, and authorization bypass, which can severely compromise application security.
Yes, the vulnerability is fixed in version 6.1.0 of the fast-jwt package. It is recommended to update to this version or later.
If you cannot update, consider removing the custom cacheKeyBuilder function or disabling caching to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-jwt.
