AIKIDO-2026-631530
@fastify/jwt is vulnerable to Authorization Bypass
81
High Risk
This Affects:
@fastify/jwtTL;DR
@fastify/jwt lets a route pass a key to request.jwtVerify() or reply.jwtSign() to scope a token to a specific authorization domain. The resolved global secret overrides that key before signature verification, so the supplied key was ignored. Applications that use separate keys for different domains would accept a token signed with the global secret on a route that explicitly required a different key. The fix verifies the key so verification and signing use the key actually supplied by the route.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass an explicit key to request.jwtVerify() or reply.jwtSign() to enforce an authorization boundary between different JWT keys.
Background info
@fastify/jwt is vulnerable to Authorization Bypass in versions 0.0.1 - 10.2.1.
How to fix this
Upgrade the @fastify/jwt library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant