fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-35039 · Microsoft / collected KEV context

GHSA-rp9m-7r4c-75qg

cve-program · CVE-2026-35039

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg
• https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb

nvd · CVE-2026-35039

• https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb
• https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg

osv · GHSA-rp9m-7r4c-75qg

• https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg
• https://nvd.nist.gov/vuln/detail/CVE-2026-35039
• https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb
• https://github.com/nearform/fast-jwt

No related operational record is retained in the current change model.