Vulnerability in Fastify Fastify\/jwt
CVE-2026-18500
@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (15.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Fastify Fastify\/jwt
- @Fastify/jwt — versions 0, 10.2.2
Weakness classification (CWE)
References
- ce714d77-add3-4f53-aff5-83d477b104bb (Mitigation, Vendor Advisory)
- ce714d77-add3-4f53-aff5-83d477b104bb (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-18500?
- CVE-2026-18500 is a high-severity vulnerability in Fastify Fastify\/jwt, classified under Improper Verification of Cryptographic Signature. CVSS score: 8.1/10. Published 2026-08-15.
- How severe is CVE-2026-18500?
- High severity. CVSS v3 base score is 8.1 out of 10.