{
  "id": 4576667,
  "title": "BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass",
  "url": "https://urgent.news/2026/08/31/breaking-cve-2026-18500-fastify-jwt-key-override-authorization-bypass",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T05:02:33.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hol/breaking-cve-2026-18500-fastifyjwt-key-override-authorization-bypass-19i7"
  },
  "original_language": "en",
  "account": "A critical security vulnerability, CVE-2026-18500, has been discovered in the popular Fastify JWT authentication library before version 10.2.2. This flaw allows attackers to bypass authorization checks by overriding the verification key used to validate JWT tokens.\n\nThe @fastify/jwt library provides a `request.jwtVerify({ key })` option that lets developers specify a unique verification key for a particular route. However, due to a flaw in how the library merges the per-request key with the globally configured secret, the global secret can overwrite the per-request key. As a result, a token signed with the global secret can be accepted by a route that intended to only accept tokens signed with a different key.\n\nThis weakness enables an attacker to impersonate a user or service by using a token generated under the wrong verification key. The National Vulnerability Database (NVD) rates this issue as HIGH severity (CVSS score 8.1), due to the potential for attackers to gain unauthorized access to protected resources.\n\nTo mitigate the risk, developers should immediately upgrade the @fastify/jwt library to version 10.2.2 or later. Packages can be updated using npm (`npm install @fastify/jwt@10.2.2`), pnpm (`pnpm up @fastify/jwt@10.2.2`), or Yarn (`yarn add @fastify/jwt@10.2.2`).\n\nIn cases where different verification keys are used for different routes (such as user, admin, tenant, or service routes), it is crucial to review authentication logs for any unexpected tokens signed under the global secret. If any misuse is detected, affected signing keys should be rotated and any exposed tokens invalidated. Further details can be found in the official HOL CVE record (https://hol.org/guard/security/cves/CVE-2026-18500-fastify-jwt-vulnerable-to-authorization-bypass-via-global-secret) and the primary GitHub Security Advisory (GHSA-j4cx-787j-xjqg).",
  "summary": "Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one authorization domain to be accepted by a route that…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}