CVE-2026-18500

Received Received - Intake

Authentication Bypass in @fastify/jwt Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: openjs

Description

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-18500

EUVD

EUVD-2026-59757

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	jwt	10.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @fastify/jwt plugin before version 10.2.2. It allows a per-request verification key to be silently overridden by the plugin's globally configured secret. This means that even if a route specifies a different key for verification, the global key is used instead, potentially allowing unauthorized access across different authorization domains.

Detection Guidance

To detect this vulnerability, check the version of @fastify/jwt in your project. Run 'npm list @fastify/jwt' or 'yarn list @fastify/jwt'. If the version is below 10.2.2, the system is vulnerable.

Impact Analysis

If you use @fastify/jwt with multiple authorization domains (e.g., separate keys for users and admins), an attacker could exploit this flaw to bypass security boundaries. A regular authenticated user might gain access to admin-only routes or data without knowing the actual secrets, leading to unauthorized actions or data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of least privilege and data protection. For GDPR, it may result in unauthorized processing or disclosure of personal data. For HIPAA, it could allow unauthorized access to protected health information, both of which could lead to compliance breaches and legal penalties.

Mitigation Strategies

Upgrade @fastify/jwt to version 10.2.2 or later immediately. Update your package.json and run 'npm update @fastify/jwt' or 'yarn upgrade @fastify/jwt'.

Hi! I’m here to help you understand CVE-2026-18500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70