Originally published at HOL
BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass
TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one authorization domain to be accepted by a route that intended to require another key.
What happened
CVE-2026-18500 is an authorization bypass in @fastify/jwt before version 10.2.2. Applications can call request.jwtVerify({ key }) when a route needs a verification key that differs from the plugin's global secret. The vulnerable option merge applies the global key after the per-request key, so the global secret wins.
