CVE-2026-18500

Katalog CVE

CVSS 8.1 · High EPSS 0,26%

Kerentanan Improper Verification of Cryptographic Signature pada fastify/jwt. Skor CVSS 3.1 8.1 (High) menurut CNA.

Deskripsi (NVD)

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.

Rincian

Terbit di NVD

15 Agustus 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cna.openjsf.org/security-advisories.html advisory vendor
• https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqg mitigasi · advisory vendor