Skip to content
OpenAdvisories

Vendor

@fastify/jwt

3 known vulnerabilities.

Products

@fastify/jwt 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-110024

    @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

    @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops ever…

    @fastify/jwt @fastify/jwt
  • Medium 6.8
    CVE-2026-107275

    @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

    @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decima…

    @fastify/jwt @fastify/jwt