CVE-2026-35039 | nearform fast-jwt up to 6.0.x data authenticity (GHSA-rp9m-7r4c-75qg)

VDB-355612 · CVE-2026-35039 · GHSA-RP9M-7R4C-75QG NEARFORM FAST-JWT UP TO 6.0.X DATA AUTHENTICITY HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 8.0 $0-$5k 2.00+ Summaryinfo A vulnerability described as critical has been identified in nearform fast-jwt up to 6.0.x. This issue affects some unknown processing. Executing a manipulation can lead to data authenticity. This vulnerability is tracked as CVE-2026-35039. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended. Detailsinfo A vulnerability has been found in nearform fast-jwt up to 6.0.x and classified as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes: fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.1.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-identified during the verification process leading to valid tokens returning claims from different valid tokens and users being mis-identified as other users based on the wrong token. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-35039 since 03/31/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. Upgrading to version 6.1.0 eliminates this vulnerability. Productinfo Vendor nearform Name fast-jwt Version 6.0 Website Product: https://github.com/nearform/fast-jwt/ CPE 2.3info 🔒 CPE 2.2info 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 8.2 VulDB Meta Temp Score: 8.0 VulDB Base Score: 7.3 VulDB Temp Score: 7.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 9.1 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Data authenticity CWE: CWE-345 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: fast-jwt 6.1.0 Timelineinfo 03/31/2026 CVE reserved 04/06/2026 +6 days Advisory disclosed 04/06/2026 +0 days VulDB entry created 04/06/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-rp9m-7r4c-75qg Status: Confirmed CVE: CVE-2026-35039 (🔒) GCVE (CVE): GCVE-0-2026-35039 GCVE (VulDB): GCVE-100-355612 Entryinfo Created: 04/06/2026 19:34 Changes: 04/06/2026 19:34 (63) Complete: 🔍 Cache ID: 99:BA3:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸