The @fastify/jwt plugin is vulnerable to improper cryptographic signature verification, which could allow authenticated users to manipulate tokens.

The vulnerability is caused by improper verification of cryptographic signatures (CWE-347), which may allow an authenticated user to bypass security checks by providing malformed or invalid tokens that the plugin fails to reject correctly.

With a CVSS score of 8.1, this vulnerability poses a high risk to applications relying on JSON Web Tokens for session and authorization management. Successful exploitation could lead to unauthorized access to sensitive user data or elevated privileges, undermining the entire authentication architecture of the affected application.

Immediate Action: Update the @fastify/jwt package to version 10.2.2 or later to resolve the signature verification flaw.

Proactive Monitoring: Monitor application logs for failed authentication attempts or unexpected token validation errors that might indicate an attempt to exploit this flaw.

Compensating Controls: If immediate patching is not possible, implement secondary server-side checks for token integrity and ensure that all JWTs are strictly validated against a strong, server-side secret.

Public Exploit Available: No.

This vulnerability is a critical issue for any Fastify application using the JWT plugin. Developers should immediately update to version 10.2.2 to ensure proper signature verification and protect the integrity of the application authentication flow.