CVE-2026-35042: fast-jwt crit header validation bypass

CVE-2026-35042 · Severity: high · CVSS 7.5 · Published 2026-04-06

fast-jwt is a Node.js library for creating and verifying JSON Web Tokens (JWTs), a widely used format for API authentication and session tokens. The library fails to validate critical header extensions as required by the JWT specification, allowing tokens with unknown extensions to be accepted when they should be rejected. This can allow attackers to bypass security policies, authenticate with modified claims, or escalate privileges in systems that rely on strict JWT validation.

Technologies: Nearform Fast-Jwt, fast-jwt (npm). Vendors: Nearform, npm.

Quick answers

Is CVE-2026-35042 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35042 being exploited in the wild.
How severe is CVE-2026-35042?
High severity, with a CVSS score of 7.5, published 6 April 2026.
Which products and versions are affected?
fast-jwt (npm) SEMVER:introduced=0,last_affected=6.1.0.
Is there a fix for CVE-2026-35042?
A patch was published on 2026-04-03: Version 6.2.0 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35042 attacked?
It is attacked over the network.
Am I affected by CVE-2026-35042?
Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an RFC 7515 §4.1.11 compliance issue in the JWT verification logic. The fast-jwt library does not validate the `crit` (Critical) header parameter, which declares non-standard extensions that the verifier must understand to safely process the token. When a JWS token contains unknown critical extensions, the library accepts it instead of rejecting it as the RFC mandates. This is a signature-validation bypass through specification non-compliance: an attacker can inject custom claims (e.g., role elevation) wrapped in unknown `crit` extensions, and the verifier will ignore the extensions and accept the token. The attack requires network access and no authentication; the vulnerability affects versions ≤6.1.0 and is patched in 6.2.0.

Affected products

  • nearform fast-jwt <=6.1.0

Identifiers

  • CVE-2026-35042
  • GHSA-hm7r-c7qw-ghp6

Timeline

  • 2026-04-03: disclosed
  • 2026-04-03: patched: Version 6.2.0 contains the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.