CVE-2026-18500

Name of the Vulnerable Software and Affected Versions @fastify/jwt versions prior to 10.2.2

Description A flaw exists where a per-request verification key passed to the request.jwtVerify({ key }) function is silently overridden by the plugin's globally configured secret due to the order of the option merge. This allows an authenticated user to bypass key-based trust boundaries, such as separate user and admin keys, by using a token signed with the global key on a route that requires a specific key.

Recommendations Update @fastify/jwt to version 10.2.2.