High severity7.5NVD Advisory· Published Apr 6, 2026· Updated Apr 10, 2026
CVE-2026-35042
CVE-2026-35042
Description
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fast-jwtnpm | <= 6.1.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-9ggr-2464-2j32ghsaADVISORY
- github.com/advisories/GHSA-hm7r-c7qw-ghp6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35042ghsaADVISORY
- www.rfc-editor.org/rfc/rfc7515.htmlnvdTechnical DescriptionWEB
News mentions
0No linked articles in our index yet.