PatchTheCVECVE-2026-35039: fast-jwt provides fast JSON Web Token (JWT) implementation
43
This month
CRITICAL 9.1REMOTEUPGRADE
CVE-2026-35039 is a critical-severity flaw (CVSS 9.1) affecting fast-jwt. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. Version
Why this priority
- Critical severity
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Publisher (CNA): GitHub, Inc. · Vendor: nearform
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
nearform fast-jwt UPGRADE
Affected: >= 0.1.0 and < 6.1.0
Fixed in: 6.1.0
Safe to downgrade to: a release before 0.1.0
1. Check installed version
npm ls fast-jwt
2. UPGRADE to 6.1.0
npm install fast-jwt@">=6.1.0"
3. If no update is available yet, DOWNGRADE to a release before 0.1.0
npm view fast-jwt versions
npm install fast-jwt@"<0.1.0"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
npm · fast-jwt · FIXED · 6.2.0 · vulnerable: >= 0.0.1, < 6.2.0 · source
npm install fast-jwt@">=6.2.0"
npm ls fast-jwt
Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source
sudo dnf upgrade --advisory=FEDORA-2026-95888f332b
Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source
sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.