Storia in 1 fonti

BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass

CVE-2026-18500 lets @fastify/jwt before 10.2.2 override a route-specific verification key with the global secret, breaking JWT authorization-domain separation. NVD scores it 8.1 HIGH.

Raccontata da

dev.to

Timeline cronologica

lunedì 31 agosto 2026·dev.to
BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass
CVE-2026-18500 lets @fastify/jwt before 10.2.2 override a route-specific verification key with the global secret, breaking JWT authorization-domain separation. NVD scores it 8.1…