{"id":"CVE-2026-35042","aliases":["GHSA-hm7r-c7qw-ghp6"],"url":"https://o3.security/vulnerability/CVE-2026-35042","summary":"fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)","details":"## Summary\n\n`fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.\n\n---\n\n## RFC Requirement\n\nRFC 7515 §4.1.11:\n\n> If any of the listed extension Header Parameters are **not understood\n> and supported** by the recipient, then the **JWS is invalid**.\n\n---\n\n## Proof of Concept\n\n```javascript\nconst { createSigner, createVerifier } = require(\"fast-jwt\"); // v3.3.3\n\nconst signer = createSigner({ key: \"secret\", algorithm: \"HS256\" });\nconst token = signer({\n  sub: \"attacker\",\n  role: \"admin\",\n  header: { crit: [\"x-custom-policy\"], \"x-custom-policy\": \"require-mfa\" },\n});\n\n// Should REJECT — x-custom-policy is not understood\nconst verifier = createVerifier({ key: \"secret\", algorithms: [\"HS256\"] });\ntry {\n  const result = verifier(token);\n  console.log(\"ACCEPTED:\", result);\n  // Output: ACCEPTED: { sub: 'attacker', role: 'admin' }\n} catch (e) {\n  console.log(\"REJECTED:\", e.message);\n}\n```\n\n**Expected:** Error — unsupported critical extension\n**Actual:** Token accepted.\n\n### Comparison\n\n```javascript\n// jose (panva) v4+ — correctly rejects\nconst jose = require(\"jose\");\nawait jose.jwtVerify(token, new TextEncoder().encode(\"secret\"));\n// throws: Extension Header Parameter \"x-custom-policy\" is not recognized\n```\n\n---\n\n## Impact\n\n- **Split-brain verification** in mixed-library environments\n- **Security policy bypass** when `crit` carries enforcement semantics\n- **Token binding bypass** (RFC 7800 `cnf` confirmation)\n- See CVE-2025-59420 for full impact analysis\n\n---\n\n## Suggested Fix\n\nIn `src/verifier.js`, add crit validation after header decoding:\n\n```javascript\nconst SUPPORTED_CRIT = new Set([\"b64\"]);\n\nfunction validateCrit(header) {\n  if (!header.crit) return;\n  if (!Array.isArray(header.crit) || header.crit.length === 0)\n    throw new Error(\"crit must be a non-empty array\");\n  for (const ext of header.crit) {\n    if (!SUPPORTED_CRIT.has(ext))\n      throw new Error(`Unsupported critical extension: ${ext}`);\n    if (!(ext in header))\n      throw new Error(`Critical extension ${ext} not present in header`);\n  }\n}\n```","published":"2026-04-06T17:02:12.180Z","modified":"2026-08-12T03:51:40.943603646Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"fast-jwt","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35042.json"},{"type":"ADVISORY","url":"https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35042"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9ggr-2464-2j32"},{"type":"PACKAGE","url":"https://github.com/nearform/fast-jwt"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.943603646Z"}}