Skip to content
OpenAdvisories

Vendor

@fastify/jwt

3 known vulnerabilities.

Products

@fastify/jwt 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-18500

    @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key

    @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global …

    @fastify/jwt @fastify/jwt