CVE-2026-110024: @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximum age, so stale or never-expiring tokens are accepted. The route-level decorators for signing and verifying already merge options and are not affected. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@fastify/jwtto a version that resolves this vulnerability.Fixed in 10.2.5
Event History
Frequently Asked Questions
Which uses of the plugin are affected?
Only the top-level sign and verify methods are affected in versions before 10.2.5 when a call supplies per-call options. Route-level signing and verification decorators already merge per-call options with global defaults and are not affected.
What condition causes expiration or maximum-age protections to be lost?
A caller must pass any per-call option to a top-level sign or verify method while relying on globally configured defaults for expiration or maximum accepted token age. The per-call options replace, rather than merge with, all global defaults not explicitly restated.
How can we identify tokens or verification paths at risk?
Review top-level sign calls that provide per-call options and rely on global expiration settings; tokens produced this way may have no expiration claim. Also review top-level verify calls with per-call options, because configured maximum token age may no longer be enforced for those calls.
What should be done if upgrading cannot happen immediately?
Avoid passing per-call options to the affected top-level methods, or explicitly restate every required global default, including temporal protections, in each per-call option set. Upgrade to @fastify/jwt 10.2.5 or later when possible.