# CVE-2026-110024: @fastify/jwt missing token expiration via options replacement

Source: https://junglewise.ai/threats/cve-2026-110024-fastify-jwt-is-a-jwt-utility-plugin-for-fastify-in-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-110024 · Severity: medium · CVSS 6.8 · Published 2026-10-18

@fastify/jwt is a plugin for the Fastify web framework that manages JSON Web Tokens for API authentication. In affected versions, the top-level sign and verify methods discard global security defaults (like token expiration and maximum age) when called with any per-call options, causing tokens to never expire and allowing indefinitely-aged tokens to be accepted. An attacker with the ability to call these methods can obtain or use tokens that should have been rejected, leading to unauthorized access or session hijacking.

Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify).

## Quick answers

**Is CVE-2026-110024 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110024 being exploited in the wild.

**How severe is CVE-2026-110024?** Medium severity, with a CVSS score of 6.8, published 18 October 2026.

**Which products and versions are affected?** Fastify @Fastify/Jwt before 10.2.5.

**Is there a fix for CVE-2026-110024?** Yes: fixed in @fastify/jwt 10.2.5. Until then: Restate the needed global defaults (such as expiresIn or maxAge) in each per-call options object, or use the route decorators reply.jwtSign and request.jwtVerify, which already merge options correctly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110024 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110024?** Check whether you run Fastify @Fastify/Jwt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in @fastify/jwt 10.2.5

Restate the needed global defaults (such as expiresIn or maxAge) in each per-call options object, or use the route decorators reply.jwtSign and request.jwtVerify, which already merge options correctly.

## Technical details

The vulnerability is an options-handling flaw in @fastify/jwt's top-level sign() and verify() methods: they replace global defaults entirely instead of merging them with per-call options. This causes temporal protections (expiresIn, maxAge, notBefore) to be silently dropped when any per-call option is passed, producing tokens with no exp claim that never expire. The attack requires the ability to call these methods, typically within application code that uses them outside route handlers (e.g., in token-issuance helpers or background services). Route-level decorators (reply.jwtSign, request.jwtVerify) are not affected as they already merge options correctly.

## Affected products

- Fastify @fastify/jwt before 10.2.5

## Timeline

- 2026-10-18: disclosed: CVE-2026-110024 published

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify-jwt/security/advisories/GHSA-f5gh-84pj-v2pg](https://github.com/fastify/fastify-jwt/security/advisories/GHSA-f5gh-84pj-v2pg)