JSON Web Token Overwrite in Fastify Plugin Causes Security Risk
CVE-2026-18500

8.1HIGH

Key Information:

Vendor

@fastify/jwt

Status
@fastify/jwt
Vendor
CVE Published:
15 August 2026

What is CVE-2026-18500?

The @fastify/jwt plugin for Fastify has a vulnerability wherein the per-request verification key provided to request.jwtVerify({ key }) is overridden by the globally configured secret. This occurs because the merge option prioritizes the global key last. As a result, applications utilizing different keys for separate authorization contexts can mistakenly accept tokens signed with the global key for routes requiring specific keys. This flaw could potentially allow authenticated users to access areas intended for different authentication scopes without knowledge of the specific keys. The issue was addressed in version 10.2.2, which ensures that an explicit per-call key takes precedence over the global secret, thus enhancing security protocols.

Affected Version(s)

@fastify/jwt 0 < 10.2.2

@fastify/jwt 10.2.2

References

https://github.com/fastify/fastify-jwt/security/advisorie...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

incogbyte
mcollina
UlisesGascon
.