EUVD-2026-281088

fkie_cve-2026-35042

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

GHSA-hm7r-c7qw-ghp6 — fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)

Affected: npm: fast-jwt

## Summary

`fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.

---

## RFC Requirement

RFC 7515 §4.1.11:

> If any of the listed extension Header Parameters are **not understood > and supported** by the recipient, then the **JWS is invalid**.

---

## Proof of Concept

```javascript const { createSigner, createVerifier } = require("fast-jwt"); // v3.3.3

const signer = createSigner({ key: "secret", algorithm: "HS256" }); const token = signer({ sub: "attacker", role: "admin", header: { crit: ["x-custom-policy"], "x-custom-policy": "require-mfa" }, });

// Should REJECT — x-custom-policy is not understood const verifier = createVerifier({ key: "secret", algorithms: ["HS256"] }); try { const result = verifier(token); console.log("ACCEPTED:", result); // Output: ACCEPTED: { sub: 'attacker', role: 'admin' } } catch (e) { console.log("REJECTED:", e.message); } ```

**Expected:** Error — unsupported critical extension **Actual:** Token accepted.

### Comparison

```javascript // jose (panva) v4+ — correctly rejects const jose = require("jose"); await jose.jwtVerify(token, new TextEncoder().encode("secret")); // throws: Extension Header Parameter "x-custom-policy" is not recognized ```

---

## Impact

- **Split-brain veri…

Most recent entries from all

EUVD-2026-281088

fkie_cve-2026-35042

GHSA-hm7r-c7qw-ghp6 — fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)