JWT Utility Plugin Vulnerability in Fastify Affected by Configuration Issues

CVE-2026-110024

What is CVE-2026-110024?

The @fastify/jwt plugin for Fastify has a configuration issue in versions prior to 10.2.5 where the top-level sign and verify methods unintentionally replace globally configured default options with per-call settings. This behavior can result in critical temporal protections being overlooked, as important elements like token expiration and maximum accepted token age are ignored if not explicitly restated within a call. This flaw allows tokens to bypass expiration, leading to the acceptance of stale or effectively eternal tokens. To mitigate this risk, users are advised to update to version 10.2.5 or later, where the issue has been resolved.

References