fastify fastify-jwt up to 10.2.4 Sign/Verify Methods sign/verify information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in fastify fastify-jwt up to 10.2.4. Affected by this issue is the function sign/verify of the component Sign/Verify Methods. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-110024. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in fastify fastify-jwt up to 10.2.4 and classified as problematic. This issue affects the function sign/verify of the component Sign/Verify Methods. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximum age, so stale or never-expiring tokens are accepted. The route-level decorators for signing and verifying already merge options and are not affected. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-110024 since 10/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 10.2.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• fastify

Name

• fastify-jwt

Version

• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4

Website

• Product: https://github.com/fastify/fastify-jwt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion