CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

fast-jwt provides fast JSON Web Token JWT implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token...

CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

fast-jwt provides fast JSON Web Token JWT implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token...

CVE-2026-35042

creationtimestamp| type| source ---|---|--- 2026-04-02 08:54:15+00:00| published-proof-of-concept| https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6 2026-04-06 17:19:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitripteju2x 2026-04-06...