Originally published at HOL

BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass

TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one authorization domain to be accepted by a route that intended to require another key.

What happened

CVE-2026-18500 is an authorization bypass in @fastify/jwt before version 10.2.2. Applications can call request.jwtVerify({ key }) when a route needs a verification key that differs from the plugin's global secret. The vulnerable option merge applies the global key after the per-request key, so the global secret wins.

That breaks key separation. A route intended to accept only tokens signed for a separate authorization domain can instead accept a token signed with the globally configured key. NVD scores the issue 8.1 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The weakness is tracked as CWE-347, improper verification of a cryptographic signature.

What to do

Upgrade @fastify/jwt to 10.2.2 or later:

npm install @fastify/jwt@10.2.2

For pnpm:

pnpm up @fastify/jwt@10.2.2

For Yarn:

yarn add @fastify/jwt@10.2.2

If your application uses different JWT keys for user, admin, tenant, or service routes, review authentication logs for tokens signed under the global key reaching routes that specify a different verification key. Rotate affected signing keys and invalidate exposed tokens if you find evidence of misuse.

Full HOL CVE record: https://hol.org/guard/security/cves/CVE-2026-18500-fastify-jwt-vulnerable-to-authorization-bypass-via-global-secret

Primary advisory: GitHub Security Advisory GHSA-j4cx-787j-xjqg

NVD: CVE-2026-18500