---
id: CVE-2026-18500
title: '@fastify/jwt is a JSON Web Token plugin for Fastify'
summary: >-
  @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before
  10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is
  silently overridden by the plugin's globally configured secret, because the
  option mer…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-347
published: '2026-08-15'
updated: '2026-08-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18500'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqg
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
ingestedAt: '2026-08-16T13:39:02.839Z'
epss: 0.00257
epssPercentile: 0.15491
---

## Overview

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.