Description
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| nearform | fast-jwt | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-hm7r-c7qw-ghp6 | fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation) |
References
History
Mon, 06 Apr 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. | |
| Title | fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | |
| Weaknesses | CWE-345 CWE-636 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-06T17:02:12.180Z
Reserved: 2026-03-31T21:06:06.428Z
Link: CVE-2026-35042
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-06T17:17:13.410
Modified: 2026-04-06T17:17:13.410
Link: CVE-2026-35042
Redhat
No data.
OpenCVE Enrichment
No data.