{"action":"Upgrade fast-jwt to 6.2.0 or later.","affected":[{"fixed":"6.2.0","introduced":"0.0.1"}],"component":"fast-jwt","cve_ids":["CVE-2026-35039"],"ecosystem":"npm","epss":0.00212,"exploited":false,"fixed_versions":["6.2.0"],"ghsa_id":"GHSA-rp9m-7r4c-75qg","id":"tcs_01M5KG9GTNF7930P9SAQ1VG2M8","modified_at":"2026-04-08T12:02:30.353217Z","published_at":"2026-04-03T04:07:09Z","references":["https://osv.dev/vulnerability/GHSA-rp9m-7r4c-75qg","https://github.com/nearform/fast-jwt/security/advisories/GHSA-rp9m-7r4c-75qg","https://nvd.nist.gov/vuln/detail/CVE-2026-35039","https://github.com/nearform/fast-jwt/commit/de121056c6415b58770c60640881eaec67ac4ceb","https://github.com/nearform/fast-jwt"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-rp9m-7r4c-75qg","url":"https://osv.dev/vulnerability/GHSA-rp9m-7r4c-75qg"}],"summary":"fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)"}