Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35042fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

High 7.5

In plain English

A high-severity insufficient verification of data authenticity in fast-jwt from nearform. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fast-jwt	no fix listed	GHSA-hm7r-c7qw-ghp6

Affected products (as reported)

Vendor	Product	Versions
nearform	fast-jwt	<= 6.1.0

Weakness: CWE-345, CWE-636 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6 x_refsource_CONFIRM
https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11 x_refsource_MISC