What’s Vulnerable › Vulnerabilities

CVE-2026-18500: @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-09-04
• Weakness: CWE-347

Description

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

Affected products

• Fastify/Jwt: before 10.2.2 — fixed in 10.2.2

How to fix

Upgrade to a fixed version: Fastify/Jwt 10.2.2. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqg

Get alerted when CVE-2026-18500 or the next vulnerability affects your stack