CVE-2026-110024: Fastify JWT Information Disclosure Flaw

CVE-2026-110024 Overview

CVE-2026-110024 affects @fastify/jwt, a JSON Web Token (JWT) utility plugin for the Fastify web framework. Versions prior to 10.2.5 contain a flaw in the top-level sign and verify methods. These methods replace globally configured defaults with per-call options rather than merging them. Any per-call option silently drops every global default the call does not restate, including temporal protections such as token expiration (expiresIn) and maxAge. The weakness is tracked under CWE-613: Insufficient Session Expiration.

Critical Impact
Tokens signed through the top-level API can be issued without an expiration claim and never expire. Verification stops enforcing the configured maximum age, so stale or never-expiring tokens are accepted.

Affected Products

@fastify/jwt versions prior to 10.2.5
Fastify applications using the top-level sign method with per-call options
Fastify applications using the top-level verify method with per-call options

Discovery Timeline

2026-10-18 - CVE-2026-110024 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-110024

Vulnerability Analysis

The plugin exposes two layers of signing and verification helpers. Route-level decorators correctly merge per-call options with the globally configured defaults. The top-level sign and verify methods instead overwrite the global configuration with the options object passed to the call.

Developers typically set security-sensitive defaults such as sign.expiresIn or verify.maxAge during plugin registration. When application code later calls the top-level method with a narrower options object, those defaults are discarded. The resulting token carries no exp claim and remains valid indefinitely. On the verification side, the configured maxAge is no longer evaluated, so expired or ancient tokens pass validation.

Root Cause

The root cause is improper option handling in the top-level API. The implementation performs an assignment of per-call options rather than a merge against the global defaults. This behavior diverges from the route-level decorators and from developer expectations, producing silent downgrades of session security controls.

Attack Vector

Exploitation requires that application code invokes the top-level sign or verify method with per-call options, which is a common pattern. An attacker who obtains a non-expiring token issued through this path can reuse it indefinitely, defeating session rotation. On the verification side, an attacker possessing a stolen or long-leaked token can authenticate even after the token's intended lifetime has passed. The attack vector is network-based and requires low privileges to obtain a token through normal issuance.

No verified public proof-of-concept is available. Technical details are documented in GitHub Security Advisory GHSA-f5gh-84pj-v2pg.

Detection Methods for CVE-2026-110024

Indicators of Compromise

JWTs issued by the application that lack an exp claim when inspected at the token payload layer.
Successful authentication events using tokens whose iat claim precedes the configured maximum age.
Session activity from accounts long after expected credential rotation windows.

Detection Strategies

Audit application source code for calls to the top-level fastify.jwt.sign and fastify.jwt.verify methods that pass per-call option objects.
Decode a sample of issued tokens and verify that each contains the exp claim consistent with the configured expiresIn.
Inventory the installed version of @fastify/jwt across services and flag any version below 10.2.5.

Monitoring Recommendations

Log token issuance events with payload metadata, including the presence and value of the exp claim.
Alert on authentication events using tokens issued before the current retention window.
Monitor dependency manifests in continuous integration pipelines for vulnerable @fastify/jwt versions.

How to Mitigate CVE-2026-110024

Immediate Actions Required

Upgrade @fastify/jwt to version 10.2.5 or later across all Fastify services.
Rotate signing keys to invalidate any non-expiring tokens that may have been issued.
Review and revoke long-lived sessions created while vulnerable code was in production.

Patch Information

The maintainers fixed the issue in @fastify/jwt 10.2.5. The patched release merges per-call options with the globally configured defaults in the top-level sign and verify methods, aligning their behavior with the route-level decorators. See the GitHub Security Advisory GHSA-f5gh-84pj-v2pg and the OpenJS Foundation Advisories for complete remediation guidance.

Workarounds

Use the route-level signing and verifying decorators, which already merge options correctly and are not affected.
Restate temporal options such as expiresIn and maxAge on every top-level sign and verify call until the upgrade is applied.
Add an application-layer check that rejects any issued or received token missing an exp claim.

bash

# Upgrade @fastify/jwt to the patched release
npm install @fastify/jwt@^10.2.5

# Verify the installed version
npm ls @fastify/jwt