[mikeflame]

Updates

• Affected products
• References

Comments
The record says <= 6.1.0 with no patched version. The maintainers' repository advisory lists 6.2.0 as patched, and the code and the published package agree. The global record was last modified on 2026-04-06, before the fix was merged and 6.2.0 was released on 2026-04-07, so the patched version was not picked up.

• In 6.1.0, verifyToken goes straight from the signature check to the typ check. src/verifier.js has no crit handling at all: https://github.com/nearform/fast-jwt/blob/v6.1.0/src/verifier.js#L177-L202
• The fix is 80b49c7 ("fix acceptance of unknown crit headers and comply with RFC 7515", from fix acceptance of unknown crit headers and comply with RFC 7515 nearform/fast-jwt#591, merged 2026-04-07). It adds validateCrit, which rejects any crit entry that is not in the new allowedCritHeaders option (empty by default) and also rejects empty or non-array crit, registered header names and duplicates: https://github.com/nearform/fast-jwt/blob/v6.2.0/src/verifier.js#L192-L233
• validateCrit is called from verifyToken right after the signature check: https://github.com/nearform/fast-jwt/blob/v6.2.0/src/verifier.js#L252-L253. Both the sync path and the async key-callback path go through verifyToken: https://github.com/nearform/fast-jwt/blob/v6.2.0/src/verifier.js#L384 and https://github.com/nearform/fast-jwt/blob/v6.2.0/src/verifier.js#L426
• git merge-base --is-ancestor shows 80b49c7 is not in the v6.1.0 tag and is in v6.2.0 (release notes: https://github.com/nearform/fast-jwt/releases/tag/v6.2.0). src/verifier.js in the npm tarballs of 6.1.0 and 6.2.0 is identical to the matching tag.

I ran the advisory's PoC against the published npm packages. As written, the PoC passes header inside the payload, so crit ends up as a payload claim and every version accepts the token. With crit in the signer's header option instead (so it is in the JOSE header, as in the fix's own test at https://github.com/nearform/fast-jwt/blob/v6.2.0/test/verifier.spec.js#L1783-L1795), the results are:

fast-jwt	sync verifier	sync verifier with cache	async key verifier
6.1.0	accepted	accepted	accepted
6.2.0	rejected (FAST_JWT_INVALID_CRIT_HEADER)	rejected	rejected
6.3.3 (latest)	rejected (FAST_JWT_INVALID_CRIT_HEADER)	rejected	rejected

A token without crit is still accepted by all three versions.

[Copilot]

🟢 Approval recommended

The metadata changes match the upstream fix and release notes, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Updates the fast-jwt advisory to identify the patched release for unknown crit header handling.

Changes:

• Records 6.2.0 as the fixed version.
• Adds references to the upstream fix commit and release notes.

File	Description
advisories/​github-reviewed/​2026/​04/​GHSA-hm7r-c7qw-ghp6/​GHSA-hm7r-c7qw-ghp6.json	Corrects the version range and adds supporting references.

_{Review effort: Max}