fast-jwt provides fast JSON Web Token (JWT) implementation.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 6, 2026 · NIST NVD

   Detected

   fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

2. Jun 17, 2026 · NIST NVD

   Updated

   fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

Affected

• cpe nearform/fast-jwtversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-35042

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-35042

  fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library

  nvd.nist.gov

References

• Exploit · github.com
• Technical Description · rfc-editor.org