CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024

The @fastify/jwt plugin for Fastify versions prior to 10.2.5 is vulnerable to missing token expiration. The top-level sign and verify methods incorrectly replace global defaults with per-call options instead of merging them. Consequently, providing any per-call option silently drops global tempor...

CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...