Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110024— @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

Quick assessment

Affected
@fastify/jwt @fastify/jwt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

@fastify/jwt 是 Fastify 框架的 JWT 工具插件。在 10.2.5 之前的版本中，顶层的 和 方法会用单次调用时传入的选项直接替换全局配置的默认值，而不是将二者合并。因此，若调用时传入任何单次选项，所有未被重新指定的全局默认配置（包括令牌过期时间、最大接受令牌年龄等时效性保护机制）将被静默丢弃。以这种方式签发的令牌将不包含过期声明，从而永远不会过期；同时，验证过程也不再强制执行已配置的最大令牌年龄限制，导致陈旧或永不过期的令牌被接受。而路由级别的签名与验证装饰器已正确合并选项，不受此问题影响。

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110024

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including temporal protections such as token expiration and maximum accepted token age. A token signed this way carries no expiration claim and never expires, and verification stops enforcing a configured maximum age, so stale or never-expiring tokens are accepted. The route-level decorators for signing and verifying already merge options and are not affected. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/jwt @fastify/jwt 0 ~ 10.2.5 -

II. Public POCs for CVE-2026-110024

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110024

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-110024 (1)

IV. Related Vulnerabilities

Same product: @fastify/jwt
Same vendor: @fastify/jwt
Same weakness: CWE-613

V. Comments for CVE-2026-110024

No comments yet

Leave a comment