CVE-2026-18500@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
Updated under an hour ago ()
Does this affect you?
It affects @fastify/jwt and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-347
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Analyzed
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
@fastify/jwt @fastify/jwt fastify_jwt:fastify_jwt (from the name) | before 10.2.2; 10.2.2 not affected | CNA record |
fastify fastify/jwt fastify:fastify/jwt | before 10.2.2 | NVD |
References
- https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqgmitigation, vendor-advisory
- https://cna.openjsf.org/security-advisories.htmlvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.