Description

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-15T14:17:07.473Z",
  "pubdate": "2026-08-15T14:17:07.473Z",
  "executiveSummary": "A security vulnerability exists in the @fastify/jwt plugin for Fastify prior to version 10.2.2, categorized as an authorization bypass resulting from improper precedence handling of cryptographic verification keys. The flaw manifests when developers pass a per-request verification key via request.jwtVerify({ key }), which is subsequently overridden by the globally configured secret due to incorrect option merging order where the global key is applied last.\nThe impact of this vulnerability allows an ordinary authenticated user to successfully cross key-based trust boundaries without possessing the secret key for the target authorization domain. For example, applications utilizing separate cryptographic keys to isolate user and admin authorization domains will improperly accept tokens signed with the global key on routes explicitly configured to require a distinct domain-specific key.\nAffected systems include any Fastify application utilizing @fastify/jwt versions below 10.2.2 that implement multi-tenant, multi-domain, or role-segmented authentication schemas relying on per-call verification keys. Exploitation requires the attacker to be an authenticated user capable of obtaining a token signed with the global secret, which can then be leveraged to access restricted routes protected by distinct per-request verification keys.",
  "technicalDetails": "The root cause of the vulnerability resides in the cryptographic key resolution logic within the @fastify/jwt plugin. Specifically, when the request.jwtVerify method is invoked with a localized options object containing a per-request verification key via request.jwtVerify({ key }), the internal option merging mechanism processes the globally configured secret after the localized parameters. Consequently, the global secret overwrites the explicitly provided per-call key prior to cryptographic verification.\nThe vulnerable component is the option parsing and key resolution routine inside @fastify/jwt affecting versions prior to 10.2.2. The attack flow proceeds as follows: First, an application defines distinct authorization domains by enforcing different verification keys across disparate routes, such as utilizing a user key and an admin key. Second, an authenticated user obtains a valid JSON Web Token signed using the globally configured secret or an accessible user-domain secret. Third, the user transmits this token against an administrative or privileged route that explicitly enforces a strict per-request verification key via request.jwtVerify({ key }). Fourth, instead of evaluating the token against the explicitly demanded per-request key, the plugin applies the globally configured secret during the verification phase due to incorrect option precedence. Fifth, because the token validates successfully against the global secret, the authorization check is bypassed, granting the ordinary user unauthorized access to restricted administrative functionalities without requiring knowledge of the specific admin secret.\nAuthentication requirements dictate that the attacker must possess a valid JSON Web Token, typically obtainable via standard low-privilege authentication mechanisms within the application. Privilege requirements are minimal; an ordinary authenticated user can exploit the flaw. Network exposure corresponds to any HTTP endpoints exposed by the Fastify web application utilizing the vulnerable @fastify/jwt middleware for route protection. Payload behavior involves standard JSON Web Tokens that validate against the fallback global secret rather than the intended domain-specific cryptographic material. Post-exploitation impact includes vertical privilege escalation, unauthorized access to sensitive administrative routes, and compromise of logical trust boundaries established between distinct application domains."
}