CVE-2026-35039: fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

April 3, 2026 (updated April 8, 2026)

NOTE: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users around the possible issues however since the defaults work we will not be updating the library beyond that for this advisory.

References

github.com/advisories/GHSA-rp9m-7r4c-75qg
github.com/nearform/fast-jwt
github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb
github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg
nvd.nist.gov/vuln/detail/CVE-2026-35039

Code Behaviors & Features

Detect and mitigate CVE-2026-35039 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →