CVE-2026-18500

COMPONENT VERSION RANGE

NewScan fingerprints @fastify/jwt from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-16. The bug is an authorization bypass, not a crypto break: an app that hands request.jwtVerify({key}) a narrower per-request key - a tenant key, a service key, a rotated key - had that key replaced by the plugin's global secret before verification, so any token the app itself could mint satisfied a check whose entire purpose was to demand a different signer. Same override on reply.jwtSign(payload, {key}). Fixed in 10.2.2. THIS IS THE FIRST SCOPED-NPM ADVISORY IN THIS PACK and it needed an engine change to be reachable at all: version_tools._techdb_names looked the dependency up by its last path segment, so `@fastify/jwt` was queried as `jwt` and could never match. Keying the row as bare `jwt` instead would have been the false-positive version of the same bug - @nestjs/jwt and @auth/jwt are unrelated packages on unrelated version series - so the fix was to try the FULL name first and keep the base as the fallback the Angular/Laravel/Maven aliases need. Version source: /package.json, /package-lock.json or /yarn.lock served from the web root (version_tools._MANIFESTS); all three npm parsers already emit the scoped name unchanged. INERT ON EXISTING INSTALLS until the next release carries that lookup change - the row alone does nothing.