CVE-2026-35039 — AI Deep Analysis Summary

🚨 **Essence**: `fast-jwt` < 6.1.0 has a flaw in `cacheKeyBuilder`. 📉 **Consequences**: Cache collisions occur, leading to **Identity Misidentification**. Users may be authenticated as someone else! 🤯

🛡️ **Root Cause**: **CWE-345** (Incorrect Implementation of Security Model). The custom `cacheKeyBuilder` fails to generate **unique keys**. 🧩 Collision = Chaos.

👥 **Affected**: `nearform`'s `fast-jwt` library. 📦 **Version**: All versions **before 6.1.0**. If you use older JWT libs, you are at risk! ⚠️

💀 **Attacker Impact**: **High** Privilege & Data impact. CVSS: **H**igh Confidentiality & Integrity loss. 🕵️‍♂️ Hackers can hijack sessions or impersonate users via cache poisoning.

🔓 **Exploitation**: **Low** Threshold. CVSS: **AV:N** (Network), **AC:L** (Low Complexity), **PR:N** (No Privs needed). 🚀 Easy to exploit remotely without auth.

🧪 **Public Exp?**: **No** PoCs listed in data. 📭 However, the flaw is logical. Wild exploitation is likely if the cache collision logic is reverse-engineered. Stay alert! 👀

🔍 **Self-Check**: Scan for `fast-jwt` usage. 📊 Check version < 6.1.0. 🔎 Look for custom `cacheKeyBuilder` implementations. If present, you are vulnerable! 🚩

✅ **Fix**: **Yes**, officially patched. 🛠️ Update to **v6.1.0** or later. 📝 Commit `de12105` fixes the key generation logic. GHSA advisory confirms it.

🚧 **No Patch?**: Avoid custom `cacheKeyBuilder` if possible. 🚫 Or ensure keys are **globally unique** (e.g., include user ID + timestamp). 🕒 Fallback to default cache if safe.

🔥 **Urgency**: **HIGH**. 🚨 CVSS is High. Identity theft is critical. 🆘 Patch immediately! Don't wait for a PoC. Update `fast-jwt` NOW! ⏳