Executive brief
fast-jwt is a Node.js library for creating and verifying JSON Web Tokens (JWTs), a widely used format for API authentication and session tokens. The library fails to validate critical header extensions as required by the JWT specification, allowing tokens with unknown extensions to be accepted when they should be rejected. This can allow attackers to bypass security policies, authenticate with modified claims, or escalate privileges in systems that rely on strict JWT validation.
Technical details
The vulnerability is an RFC 7515 §4.1.11 compliance issue in the JWT verification logic. The fast-jwt library does not validate the `crit` (Critical) header parameter, which declares non-standard extensions that the verifier must understand to safely process the token. When a JWS token contains unknown critical extensions, the library accepts it instead of rejecting it as the RFC mandates. This is a signature-validation bypass through specification non-compliance: an attacker can inject custom claims (e.g., role elevation) wrapped in unknown `crit` extensions, and the verifier will ignore the extensions and accept the token. The attack requires network access and no authentication; the vulnerability affects versions ≤6.1.0 and is patched in 6.2.0.
Affected products
- nearform fast-jwt <=6.1.0
Timeline
- 2026-04-03: disclosed
- 2026-04-03: patched: Version 6.2.0 contains the fix