BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass

Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one authorization domain to be accepted by a route that intended to require another key. What happened CVE-2026-18500 is an authorization bypass in @fastify/jwt before version 10.2.2 . Applications can call request.jwtVerify({ key }) when a route needs a verification key that differs from the plugin's global secret. The vulnerable option merge applies the global key after the per-request key, so the global secret wins. That breaks key separation. A route intended to accept only tokens signed for a separate authorization domain can instead accept a token signed with the globally configured key. NVD scores the issue 8.1 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N . The weakness is tracked as CWE-347 , improper verification of a cryptographic signature. What to do Upgrade @fastify/jwt to 10.2.2 or later: npm install @fastify/jwt@10.2.2 For pnpm: pnpm up @fastify/jwt@10.2.2 For Yarn: yarn add @fastify/jwt@10.2.2 If your application uses different JWT keys for user, admin, tenant, or service routes, review authentication logs for tokens signed under the global key reaching routes that specify a different verification key. Rotate affected signing keys and invalidate exposed tokens if you find evidence of misuse. Full HOL CVE record: https://hol.org/guard/security/cves/CVE-2026-18500-fastify-jwt-vulnerable-to-authorization-bypass-via-global-secret Primary advisory: GitHub Security Advisory GHSA-j4cx-787j-xjqg NVD: CVE-2026-18500 Top comments (0)