CyberSecBulletin

@fastify/jwt vulnerabilities

We track 1 vulnerability in @fastify/jwt products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 15, 2026.

1vulnerabilities
0critical
1high
0exploited
8.1average CVSS score

Latest @fastify/jwt vulnerabilities

  • 8.1 High severity

    @fastify/jwt: Improper Verification of Cryptographic Signature

    CVE-2026-18500@fastify/jwt

    @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global k