# CVE-2026-35042: fast-jwt crit header validation bypass

Source: https://junglewise.ai/threats/cve-2026-35042-fast-jwt-crit-header-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35042 · Severity: high · CVSS 7.5 · Published 2026-04-06

fast-jwt is a Node.js library for creating and verifying JSON Web Tokens (JWTs), a widely used format for API authentication and session tokens. The library fails to validate critical header extensions as required by the JWT specification, allowing tokens with unknown extensions to be accepted when they should be rejected. This can allow attackers to bypass security policies, authenticate with modified claims, or escalate privileges in systems that rely on strict JWT validation.

Technologies: [Nearform Fast-Jwt](https://junglewise.ai/threats/technologies/nearform-fast-jwt), [fast-jwt (npm)](https://junglewise.ai/threats/technologies/fast-jwt). Vendors: [Nearform](https://junglewise.ai/threats/vendors/nearform), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-35042 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35042 being exploited in the wild.

**How severe is CVE-2026-35042?** High severity, with a CVSS score of 7.5, published 6 April 2026.

**Which products and versions are affected?** fast-jwt (npm) SEMVER:introduced=0,last_affected=6.1.0.

**Is there a fix for CVE-2026-35042?** A patch was published on 2026-04-03: Version 6.2.0 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35042 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-35042?** Check whether you run Nearform Fast-Jwt or fast-jwt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an RFC 7515 §4.1.11 compliance issue in the JWT verification logic. The fast-jwt library does not validate the `crit` (Critical) header parameter, which declares non-standard extensions that the verifier must understand to safely process the token. When a JWS token contains unknown critical extensions, the library accepts it instead of rejecting it as the RFC mandates. This is a signature-validation bypass through specification non-compliance: an attacker can inject custom claims (e.g., role elevation) wrapped in unknown `crit` extensions, and the verifier will ignore the extensions and accept the token. The attack requires network access and no authentication; the vulnerability affects versions ≤6.1.0 and is patched in 6.2.0.

## Affected products

- nearform fast-jwt <=6.1.0

## Identifiers

- CVE-2026-35042
- GHSA-hm7r-c7qw-ghp6

## Timeline

- 2026-04-03: disclosed
- 2026-04-03: patched: Version 6.2.0 contains the fix

## References

- [https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6](https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6)

## Related threats

- [fast-jwt JWK JSON HMAC secret misclassification in HS256 verification](https://junglewise.ai/threats/cve-2026-107724-fast-jwt-treats-raw-public-jwk-json-as-an-hmac-secret-enabling)
- [fast-jwt claim-validator bypass with JSON array payload](https://junglewise.ai/threats/cve-2026-107723-fast-jwt-silent-claim-validator-bypass-when-jwt-payload-is-a)
- [fast-jwt incomplete RSA-to-HS256 algorithm confusion fix](https://junglewise.ai/threats/cve-2026-107722-fast-jwt-incomplete-patch-of-non-whitespace-key-prefix-re)
- [fast-jwt clockTolerance validation bypass in expiry and not-before checks](https://junglewise.ai/threats/cve-2026-107721-fast-jwt-clocktolerance-infinity-silently-bypasses-both-exp-and)
- [fast-jwt signature verification bypass with null/empty key](https://junglewise.ai/threats/cve-2026-107720-fast-jwt-createverifier-accepts-unsigned-jwts-when-key-is-or)