The fast-jwt library provides a fast implementation of JSON Web Tokens (JWT). In versions 6.1.0 and earlier, it fails to enforce validation of the 'crit' header parameter as specified in RFC 7515 §4.1.11. The 'crit' header indicates critical extensions that must be understood and processed by the JWT consumer. If the library encounters unknown critical extensions listed in the 'crit' array, it should reject the token. Instead, fast-jwt accepts such tokens, violating the RFC's MUST requirement. This flaw corresponds to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-636 (Not Authorized). The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity impact and no availability impact.

An attacker could craft a JWT containing unknown critical extensions in the 'crit' header, which fast-jwt would accept without proper validation. This can lead to acceptance of tokens that should have been rejected, potentially allowing unauthorized actions or bypassing integrity checks. The integrity of the system relying on fast-jwt for token validation is compromised. There is no known exploit in the wild as of the published date.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, avoid using fast-jwt versions 6.1.0 and earlier in security-critical environments or implement additional validation of the 'crit' header parameter externally.