CVE-2026-18500

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

• CWE-347

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqgMitigation, Vendor Advisory

Published

Aug 15, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1849MongoDB Server may experience an out-of-memory failure while…7.5
• CVE-2026-18490IBM Financial Transaction Manager (FTM) for RedHat OpenShift…8.8
• CVE-2026-18495A flaw was found in libtiff. A heap-buffer overflow vulnerab…6.1
• CVE-2026-18497A heap-buffer-overflow vulnerability exists in the nothings …7.1
• CVE-2026-18499IBM WebSphere Application Server - Liberty 17.0.0.3 through …8.1
• CVE-2026-1850Complex queries can cause excessive memory usage in MongoDB …7.5
• CVE-2026-18501The UsersWP – Front-end login form, User Registration, User …6.4
• CVE-2026-18502Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-18503Attacker-controlled CSV samples can trigger super-linear re…2.4
• CVE-2026-18504fastify is a fast and low overhead web framework for Node.js…5.3
• CVE-2026-18505IBM Financial Transaction Manager (FTM) for RedHat OpenShift…5.4
• CVE-2026-18508A flaw was found in GNU tar. When extracting an archive with…4.4