A security vulnerability CVE-2026-18500 affects @fastify/jwt versions before 10.2.2, potentially allowing an authorization bypass.

Review logs for tokens signed with the global key, rotate affected signing keys, and invalidate exposed tokens if misuse is detected.

Official references include the HOL CVE record, the GitHub advisory GHSA-j4cx-787j-xjqg, and the NVD entry, with links for more details.

The vulnerability is rated 8.1 (High) on CVSS v3.1, and involves improper verification of cryptographic signatures (CWE-347) with a vector of no network access, low attack complexity, requiring level permissions, and resulting in confidentiality and integrity impacts.

The flaw occurs when a route uses request.jwtVerify({ key }) with a per-route verification key, but the globally configured secret overrides it due to the option merge behavior.

Remediation involves upgrading to @fastify/jwt version 10.2.2 or newer using npm, pnpm, or yarn, and applying the patch as soon as possible.

The issue undermines key separation, allowing tokens signed for one domain to be accepted by routes secured with a different key.