CVE-2026-35042 — Insufficient Verification of Data Authenticity in Fast-jwt

CWE-345 — Insufficient Verification of Data AuthenticityCWE-636 — Failing Open4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 94.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nearform Fast-jwt
Timeline
Latest updateApr 3
PublishedApr 6

Description

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDnearform/fast-jwt< 6.2.0
▶CVEListV5nearform/fast-jwt6.1.0

🔴Vulnerability Details

2
GHSA
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)↗2026-04-03
▶
OSV
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)↗2026-04-03
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-35042 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶