@fastify/jwt vulnerabilities

@fastify/jwt versions prior to 10.2.5 have top-level sign and verify methods that replace globally configured defaults with per-call options instead of merging them. This silently drops temporal protections such as token expiration and maximum accepted token age, so tokens never expire.

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the parser cannot read is silently dropped instead of refused. This produces tokens with no expiration on signing, and on verification maxAge stops being enforced, so tokens that should be rejected are accepted. The issue is fixed in 10.2.3.

In @fastify/jwt, a JSON Web Token plugin for Fastify, versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret. Applications using different keys for different authorization domains may accept tokens signed with the global key on routes requiring another key, allowing an ordinary authenticated user to cross a key-based trust boundary. The issue is fixed in version 10.2.2.