The vulnerability in nearform's fast-jwt library (versions 6.1.0 and earlier) arises from improper handling of the 'crit' header parameter in JSON Web Signature (JWS) tokens. According to RFC 7515 §4.1.11, if a JWS token includes a 'crit' array specifying critical extensions that the implementation does not understand, the token must be rejected. fast-jwt fails to enforce this requirement, accepting tokens with unrecognized critical extensions. This constitutes insufficient verification of data authenticity (CWE-345) and improper input validation (CWE-636). The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity compromise.

An attacker could craft a JWS token containing unrecognized critical header extensions that fast-jwt accepts without proper validation. This flaw allows the acceptance of potentially malicious or tampered tokens, violating the integrity guarantees of JWTs. Although confidentiality and availability are not impacted, the integrity of token data can be compromised, potentially leading to unauthorized actions or bypass of security controls relying on token validation.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor advisory for updates. Until a fix is released, avoid using fast-jwt versions 6.1.0 and earlier in security-critical contexts or implement additional validation of the 'crit' header parameter externally to ensure compliance with RFC 7515 §4.1.11.