high7.5
CVE-2026-35042
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Impact
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fast-jwt | <= 6.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nearform | Fast-Jwt | before 6.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6
- https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11
- https://github.com/advisories/GHSA-hm7r-c7qw-ghp6
- https://github.com/advisories/GHSA-9ggr-2464-2j32
- https://nvd.nist.gov/vuln/detail/CVE-2026-35042