CVE-2026-35042

EUVD-2026-19382
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
nearformfast-jwt
𝑥
< 6.2.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6
https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11
https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6