CVE-2026-35042

OVERVIEW CVE-2026-35042 affects fast-jwt version 6.1.0 and earlier, a widely-used JSON Web Token implementation library. The vulnerability stems from improper validation of the "crit" (Critical) Header Parameter as defined in RFC 7515. When a JWS token contains a crit array referencing extensions that fast-jwt does not understand, the library incorrectly accepts the token rather than rejecting it, violating RFC requirements for critical header validation. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, making exploitation straightforward for any remote attacker. The impact is primarily integrity-related, as attackers could potentially bypass security controls by crafting tokens with unrecognized critical extensions that the library fails to validate, though confidentiality and availability are not directly affected. EXPLOITATION STATUS The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.0002 indicates extremely low probability of exploitation based on current threat intelligence. Community attention appears minimal, with the vulnerability remaining on inactive status. However, the moderate FAUCET Risk Score of 48.0 suggests organizations using fast-jwt should still prioritize updating to patched versions as part of routine security maintenance.