---
id: CVE-2026-110024
title: >-
  @fastify/jwt vulnerable to missing token expiration when per-call options drop
  global defaults
summary: >-
  @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5,
  the top-level sign and verify methods replace the globally configured defaults
  with the per-call options instead of merging them, so passing any per-call
  opti…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: '@fastify/jwt'
product: '@fastify/jwt'
affected:
  - '@fastify/jwt < 10.2.5'
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T14:31:38.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110024'
references:
  - url: >-
      https://github.com/fastify/fastify-jwt/security/advisories/GHSA-f5gh-84pj-v2pg
  - url: 'https://cna.openjsf.org/security-advisories.html'
tags:
  - cve.org
ingestedAt: '2026-10-18T14:44:23.536Z'
---

## Overview

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximum age, so stale or never-expiring tokens are accepted. The route-level decorators for signing and verifying already merge options and are not affected. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.

## Affected

- `@fastify/jwt < 10.2.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.