CVE-2026-35042 Details
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
A vulnerability exists in fast-jwt versions through 6.1.0, where the library fails to properly validate the 'crit' (Critical) Header Parameter in JSON Web Signatures (JWS). According to RFC 7515 §4.1.11, if a JWS token includes a 'crit' array with unrecognized extensions, the token should be rejected. However, fast-jwt accepts such tokens, violating the RFC's requirements. This issue can lead to 'split-brain' verification in environments using different libraries, bypassing security policies that rely on 'crit' extensions, and ignoring token binding requirements under RFC 7800.
Users are advised to update to fast-jwt version 6.1.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6 | [email protected] | ExploitMitigationVendor Advisory |
| https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-636 | Not Failing Securely ('Failing Open') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nearform fast-jwt | < 6.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |