BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass

Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A route that passes a specific verification key to request.jwtVerify({ key }) can have that key overwritten by the globally configured secret, allowing a token valid for one...