Npm · @Fastify/Jwt · CVE-2026-110024
**Name of the Vulnerable Software and Affected Versions**
@fastify/jwt versions prior to 10.2.5
**Description**
In the top-level `sign()` and `verify()` methods, per-call options replace globally configured defaults instead of merging with them. This behavior causes any global default not explicitly restated in the per-call options to be dropped, including temporal protections like token expiration and maximum accepted token age. Consequently, tokens signed using this method may lack an expiration claim and never expire, while verification may fail to enforce the configured maximum age, allowing stale or permanent tokens to be accepted.
**Recommendations**
Upgrade to version 10.2.5 or later.