CyberRota Analysis
AI-GeneratedThe @fastify/jwt plugin for Fastify prior to version 10.2.2 contains a vulnerability that allows an authenticated user to bypass key-based trust boundaries by using a globally configured secret instead of a per-request verification key. This flaw can lead to unauthorized access across different authorization domains, potentially compromising sensitive operations. Developers and organizations utilizing this plugin should prioritize upgrading to version 10.2.2 to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)