Npm · @Fastify/Jwt · CVE-2026-18500
**Name of the Vulnerable Software and Affected Versions**
@fastify/jwt versions prior to 10.2.2
**Description**
A flaw exists where a per-request verification key passed to the `request.jwtVerify({ key })` function is silently overridden by the plugin's globally configured secret due to the order of the option merge. This allows an authenticated user to bypass key-based trust boundaries, such as separate user and admin keys, by using a token signed with the global key on a route that requires a specific key.
**Recommendations**
Update @fastify/jwt to version 10.2.2.