CVE-2026-35042 fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Attackers can bypass JWT security checks by using unknown critical header extensions, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35042?
CVE-2026-35042 is a high-severity vulnerability in nearform fast-jwt, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
Which versions are affected by CVE-2026-35042?
2 open source packages ship an affected version, including fast-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-jwt npm | All versions to 6.1.0 | None |
fast-jwt npm | All versions to 6.1.0 | None |
Products include Nearform Fast-Jwt.
How do I fix CVE-2026-35042?
No fix has been published for CVE-2026-35042 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35042 exists.
Other vulnerabilities in nearform fast-jwt
- CVE-2026-34950 fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
- CVE-2026-35039 fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
- CVE-2023-48223 fast-jwt JWT Algorithm Confusion
- CVE-2026-35040 fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
- CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification
Sources
Also known as GHSA-hm7r-c7qw-ghp6.