Executive brief
@fastify/jwt is a JSON Web Token authentication plugin for the Fastify web framework. In affected versions, an explicit per-request verification key is silently overridden by the plugin's global secret, allowing an authenticated user to use a token signed with the global key to access routes that require a different key. This bypasses authorization boundaries between separate security domains (e.g., user vs. admin access).
Technical details
This is an improper cryptographic signature verification vulnerability (CWE-347) in @fastify/jwt versions before 10.2.2. The root cause is that the plugin's option merge logic applies the global secret last, overriding any per-request key explicitly passed to request.jwtVerify({ key }) or reply.jwtSign(payload, { key }). An authenticated attacker with a token signed using the global secret can exploit this to bypass authorization checks on routes designed to accept only tokens signed with a different key. The vulnerability requires the attacker to be already authenticated (low privilege) but no user interaction or out-of-band information about the target key is needed. The attack vector is network-based. Direct verification using fastify.jwt.verify(token, { key }) is not affected. The issue is fixed in version 10.2.2, where per-call keys take precedence over global secrets.
Affected products
- OpenJS Foundation @fastify/jwt < 10.2.2
Timeline
- 2026-08-14: disclosed
- 2026-08-15: advisory
- 2026-08-15: patched: Version 10.2.2 released