fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

Source published

6 Apr 2026 17:02:12 UTC

Source modified

7 Apr 2026 15:59:49 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

Source published

6 Apr 2026 17:17:13 UTC

Source modified

24 Oct 2026 13:10:00 UTC

Observed here

25 Oct 2026 08:17:35 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

## Summary `fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC. --- ## RFC Requirement RFC 7515 §4.1.11: > If any of the listed extension Header Parameters are **not understood > and supported** by the recipient, then the **JWS is invalid**. --- ## Proof of Concept ```javascript const { createSigner, createVerifier } = require("fast-jwt"); // v3.3.3 const signer = createSigner({ key: "secret", algorithm: "HS256" }); const token = signer({ sub: "attacker", role: "admin", header: { crit: ["x-custom-policy"], "x-custom-policy": "require-mfa" }, }); // Should REJECT — x-custom-policy is not understood const verifier = createVerifier({ key: "secret", algorithms: ["HS256"] }); try { const result = verifier(token); console.log("ACCEPTED:", result); // Output: ACCEPTED: { sub: 'attacker', role: 'admin' } } catch (e) { console.log("REJECTED:", e.message); } ``` **Expected:** Error — unsupported critical extension **Actual:** Token accepted. ### Comparison ```javascript // jose (panva) v4+ — correctly rejects const jose = require("jose"); await jose.jwtVerify(token, new TextEncoder().encode("secret")); // throws: Extension Header Parameter "x-custom-policy" is not recognized ``` --- ## Impact - **Split-brain verification** in mixed-library environments - **Security policy bypass** when `crit` carries enforcement semantics - **Token binding bypass** (RFC 7800 `cnf` confirmation) - See CVE-2025-59420 for full impact analysis --- ## Suggested Fix In `src/verifier.js`, add crit validation after header decoding: ```javascript const SUPPORTED_CRIT = new Set(["b64"]); function validateCrit(header) { if (!header.crit) return; if (!Array.isArray(header.crit) || header.crit.length === 0) throw new Error("crit must be a non-empty array"); for (const ext of header.crit) { if (!SUPPORTED_CRIT.has(ext)) throw new Error(`Unsupported critical extension: ${ext}`); if (!(ext in header)) throw new Error(`Critical extension ${ext} not present in header`); } } ```

Source published

3 Apr 2026 22:01:25 UTC

Source modified

6 Apr 2026 23:49:39 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Publisher rating · HIGH