CVE-2026-110024
MediumCVSS 6.8Summary
@fastify/jwt versions prior to 10.2.5 have top-level sign and verify methods that replace globally configured defaults with per-call options instead of merging them. This silently drops temporal protections such as token expiration and maximum accepted token age, so tokens never expire.
Risk Assessment
JWT tokens without an expiration date can be used indefinitely, significantly increasing the risk of unauthorized access if a token leaks. Organizations using this plugin are exposed to permanent session takeover.
Recommendation
Upgrade @fastify/jwt to version 10.2.5 or later, which fixes the issue. Additionally, audit existing tokens for the absence of the exp claim.
Other vulnerabilities in @fastify/jwt
See all- CVE-2026-107275Medium
@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the parser cannot read is silently dropped instead of refused. This produces tokens with no expiration on signing, and on verification maxAge stops being enforced, so tokens that should be rejected are accepted. The issue is fixed in 10.2.3.
- CVE-2026-18500High
In @fastify/jwt, a JSON Web Token plugin for Fastify, versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret. Applications using different keys for different authorization domains may accept tokens signed with the global key on routes requiring another key, allowing an ordinary authenticated user to cross a key-based trust boundary. The issue is fixed in version 10.2.2.
Original NVD description (English source)
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximum age, so stale or never-expiring tokens are accepted. The route-level decorators for signing and verifying already merge options and are not affected. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS