CVE-2026-18500

creationtimestamp| type| source ---|---|--- 2026-08-15 13:22:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mt4rdgqdgk2i 2026-08-15 15:00:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt4wsxbwjr2o...

CVE-2026-18500 @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...