fast-jwt is a fast JSON Web Token implementation that, for versions 0.0.1 through 6.1.x, allowed a custom cacheKeyBuilder function that could be implemented incorrectly. When this function did not generate a unique key for each token, the library’s cache could store a token’s verification result under a key that later matched a different token. As a consequence, verification of one token could return claims from another valid token, causing a user to be misidentified as a different user. This defect permits an attacker to obtain the identity and authorization claims of another party without possessing the target’s private key or token.

Node.js applications or other projects that depend on the nearform:fast-jwt package, specifically any installations using version 0.0.1 up to but not including 6.2.0. If a custom cacheKeyBuilder is supplied, the risk applies regardless of the specific package version within that range.

The vulnerability is scored highly with a CVSS 9.1 and a low EPSS (<1%), which means exploitation is possible but not yet widespread. It is not listed in the CISA KEV catalog, suggesting no known active exploitation at the time of the advisory. The likely attack scenario requires the attacker to influence the cacheKeyBuilder setting or supply a token that causes a built‑in cache collision. Successful exploitation would allow the attacker to impersonate another user or gain unauthorized access to resources that the victim’s token is authorized to use.