The vulnerability in @fastify/jwt causes the top‑level sign and verify methods to replace any global defaults with the options passed in the individual call, silently discarding options that are not repeated. As a result, a token created with per‑call options may lack an expiration claim, never expires, and the verification process stops enforcing the maximum token age. Tokens issued in this manner remain valid indefinitely, allowing attackers to keep using stale or never‑expiring tokens, which can lead to unauthorized access to protected resources and a broader impact on confidentiality and integrity. This weakness is classified as CWE‑613, an insufficient protection of authentication credentials.

Any Node.js application using the @fastify/jwt plugin version prior to 10.2.5. The issue is confined to the plugin itself; route‑level decorators that merge options are not affected. Users of older versions should be aware that tokens signed or verified via the top‑level methods may be missing expiration or maximum‑age checks.

The CVSS score of 6.8 indicates moderate severity. The lack of an EPSS score means the current exploitation probability is unknown, though the vulnerability introduces a significant risk due to the potential for perpetual token validity. The vulnerability is not listed in CISA KEV. Attackers generally need to supply code that calls the sign or verify functions without providing explicit expiration options, or rely on the fact that existing signing code in an application might already produce tokens without expiry. The prior default settings are dropped, so body‑injection attacks or accidental misuse can easily trigger the issue. The best mitigation is to update to version 10.2.5 or later, which restores the merging behavior and ensures tokens contain the expected temporal claims.