Originally published at HOL
BREAKING: CVE-2026-18500 – @fastify/jwt key override authorization bypass
TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one authorization domain to be accepted by a route that intended to require another key.
What happened
CVE-2026-18500 is an authorization bypass in @fastify/jwt before version 10.2.2. Applications can call request.jwtVerify({ key }) when a route needs a verification key that differs from the plugin’s global secret. The vulnerable option merge applies the global key after the per-request key, so the global secret wins.
That breaks key separation. A route intended to accept only tokens signed for a separate authorization domain can instead accept a token signed with the globally configured key. NVD scores the issue 8.1 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The weakness is tracked as CWE-347, improper verification of a cryptographic signature.
What to do
Upgrade @fastify/jwt to 10.2.2 or later:
npm install @fastify/[email protected]
Enter fullscreen mode Exit fullscreen mode
For pnpm:
pnpm up @fastify/[email protected]
Enter fullscreen mode Exit fullscreen mode
For Yarn:
yarn add @fastify/[email protected]
Enter fullscreen mode Exit fullscreen mode
If your application uses different JWT keys for user, admin, tenant, or service routes, review authentication logs for tokens signed under the global key reaching routes that specify a different verification key. Rotate affected signing keys and invalidate exposed tokens if you find evidence of misuse.
Full HOL CVE record: https://hol.org/guard/security/cves/CVE-2026-18500-fastify-jwt-vulnerable-to-authorization-bypass-via-global-secret
Primary advisory: GitHub Security Advisory GHSA-j4cx-787j-xjqg
NVD: CVE-2026-18500