CVE-2026-110024 @fastify/jwt CVE debrief

Who should care

Defenders and developers using @fastify/jwt should assess exposure and upgrade to 10.2.5 or later. The vulnerability affects @fastify/jwt, allowing tokens to be signed without expiration claims and verification to not enforce maximum token age. This issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later.

Why it matters

CVE-2026-110024 affects @fastify/jwt, allowing tokens to be signed without expiration claims and verification to not enforce maximum token age. Defenders and developers should assess exposure and upgrade to 10.2.5 or later.

• Tokens signed with per-call options may not expire
• Verification may not enforce maximum token age
• Stale or never-expiring tokens may be accepted

Technical summary

The top-level sign and verify methods in @fastify/jwt versions prior to 10.2.5 replace the globally configured defaults with the per-call options instead of merging them. This results in tokens being signed without expiration claims and verification not enforcing maximum token age. The issue is fixed in @fastify/jwt 10.2.5, and users should upgrade to 10.2.5 or later to fix the issue. The vulnerability affects @fastify/jwt, allowing tokens to be signed without expiration claims and verification to not enforce maximum token age.

Defensive priority

Upgrade to @fastify/jwt 10.2.5 or later to fix the issue.

Recommended defensive actions

• Upgrade to @fastify/jwt 10.2.5 or later
• Review and update affected systems
• Verify token expiration and maximum age configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue is fixed in @fastify/jwt 10.2.5. The top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them. This results in tokens being signed without expiration claims and verification not enforcing maximum token age. Defenders and developers should assess exposure and upgrade to 10.2.5 or later. The CVE record was published on 2026-10-18T15:16:51.417Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.