CVE-2026-18500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18500
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18500.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18500
Aliases
  • GHSA-j4cx-787j-xjqg
Published
2026-08-15T13:16:12Z
Modified
2026-09-06T03:45:50Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
@fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
Details

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

Database specific 
{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18500.json"
}
References

Affected packages

Git / github.com/fastify/fastify-jwt

Affected ranges

Type
GIT
Repo
https://github.com/fastify/fastify-jwt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0fa894171e3af59f26b96cac45ed8ab8c2cfc276
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:fastify:fastify\\/jwt:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

8.*
8.0.1
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v10.*
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.2.0
v3.2.1
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v5.*
v5.0.0
v5.0.1
v6.*
v6.0.0
v6.1.0
v6.2.0
v6.2.1
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.4.0
v6.5.0
v6.6.0
v6.7.0
v6.7.1
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.2.1
v7.2.2
v7.2.3
v7.2.4
v8.*
v8.0.0
v8.0.1
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18500.json"