CVE-2026-35042: fast-jwt Critical Header Vulnerability

CVE-2026-35042 Overview

CVE-2026-35042 is a Certificate Validation Bypass vulnerability in fast-jwt, a popular JSON Web Token (JWT) implementation for Node.js. In versions 6.1.0 and earlier, fast-jwt fails to properly validate the crit (Critical) Header Parameter as defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library incorrectly accepts the token instead of rejecting it, violating the MUST requirement specified in the RFC.

Critical Impact

Applications using fast-jwt may accept maliciously crafted JWT tokens containing unrecognized critical extensions, potentially allowing attackers to bypass security controls or authentication mechanisms that rely on proper JWT validation.

Affected Products

• fast-jwt versions 6.1.0 and earlier
• Applications using fast-jwt for JWT validation
• Node.js services implementing JWT-based authentication with fast-jwt

Discovery Timeline

• 2026-04-06 - CVE CVE-2026-35042 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35042

Vulnerability Analysis

This vulnerability stems from improper validation of the JWT header's crit parameter. According to RFC 7515 Section 4.1.11, implementations MUST reject JWS tokens that contain critical header parameters they do not understand. The fast-jwt library fails to enforce this requirement, creating a security gap where tokens with unrecognized critical extensions are accepted rather than rejected.

The vulnerability is classified under CWE-345 (Insufficient Verification of Data Authenticity), as the library does not sufficiently verify that the token conforms to the required security specifications before accepting it.

Root Cause

The root cause of CVE-2026-35042 lies in the incomplete implementation of RFC 7515 compliance within fast-jwt. The library's token validation logic does not properly iterate through the crit array in JWT headers to verify that all listed extensions are understood and supported. When encountering unknown extensions in the crit array, the library should reject the token but instead proceeds with acceptance.

Attack Vector

An attacker can exploit this vulnerability by crafting a JWT token with a crit header parameter containing extension names that fast-jwt does not recognize. The attack is network-based and requires no authentication or user interaction. When such a token is submitted to an application using vulnerable versions of fast-jwt, the token will be incorrectly validated as legitimate.

The crit parameter is designed as a security mechanism to ensure that critical security extensions are properly processed. By bypassing this validation, attackers may be able to circumvent security controls that depend on custom JWT extensions, potentially leading to authorization bypass or token forgery scenarios.

For technical details on exploitation, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35042

Indicators of Compromise

• JWT tokens containing crit header parameters with unusual or unexpected extension names
• Authentication logs showing accepted tokens with unrecognized critical extensions
• Anomalous JWT header structures in application access logs

Detection Strategies

• Implement logging of all JWT crit parameter values at the application layer
• Monitor for JWT tokens with crit arrays containing non-standard extension names
• Audit authentication success events for tokens that should have been rejected based on unknown critical extensions
• Deploy application-layer monitoring to detect unusual JWT header patterns

Monitoring Recommendations

• Enable verbose logging for JWT validation operations in affected applications
• Create alerts for authentication events involving JWTs with crit header parameters
• Review application dependencies regularly for vulnerable fast-jwt versions
• Implement centralized logging for JWT-related security events across all services

How to Mitigate CVE-2026-35042

Immediate Actions Required

• Audit all applications and services to identify usage of fast-jwt versions 6.1.0 or earlier
• Update fast-jwt to the latest patched version that properly validates the crit header parameter
• Review authentication logs for potential exploitation attempts involving unusual JWT headers
• Consider implementing additional JWT validation at the application layer as defense-in-depth

Patch Information

Update fast-jwt to a version newer than 6.1.0 that includes the fix for proper crit header validation. Consult the GitHub Security Advisory for specific version information and patch details.

Workarounds

• Implement custom validation logic to check the crit header parameter before passing tokens to fast-jwt
• Add application-layer middleware to reject JWTs containing crit arrays with unrecognized extensions
• Consider switching to an alternative JWT library that properly implements RFC 7515 §4.1.11 until fast-jwt is updated
• Deploy a reverse proxy or API gateway rule to filter requests containing JWTs with suspicious crit header values

# Example: Check fast-jwt version in your project
npm list fast-jwt

# Update to the latest version
npm update fast-jwt

# Or specify a fixed version in package.json
npm install fast-jwt@latest