SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

CVE-2026-18500: Critical Auth Bypass Found in @fastify/jwt Before v10.2.2

0
·1 views

A high-severity vulnerability, CVE-2026-18500, has been disclosed in the @fastify/jwt library affecting all versions prior to 10.2.2. The flaw allows a globally configured JWT secret to override a per-route verification key during token validation, breaking intended key separation between authorization domains. As a result, a token signed with the global secret can be incorrectly accepted by routes that were designed to require a different, route-specific key. The National Vulnerability Database has scored the issue 8.1 HIGH under CVSS 3.1, classifying it as CWE-347 (improper verification of a cryptographic signature). Developers are advised to upgrade to @fastify/jwt version 10.2.2 or later immediately and to rotate any signing keys that may have been exposed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Nginx FastCGI Cache Outperforms WordPress Plugins for WooCommerce Traffic Spikes

A development team migrated a production WooCommerce store from plugin-based page caching to Nginx FastCGI cache to better handle high-concurrency traffic. Unlike caching plugins such as WP Rocket or W3 Total Cache, which still consume PHP-FPM worker slots even when serving cached pages, Nginx FastCGI cache responds entirely at the web server layer without invoking PHP at all. This distinction matters little under low traffic but becomes critical during promotional spikes, where a limited PHP-FPM pool can cause queuing and site slowdowns. The team found that FastCGI cache reserves PHP capacity exclusively for dynamic requests like cart and checkout flows, significantly improving scalability. However, the migration also introduced real-world complications, particularly around cookie-based cache bypass logic tied to WooCommerce session and cart cookies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tutorial: Build a JavaScript Tool to Calculate Crypto Trade Risk Before Ordering

A developer on DEV Community has published a tutorial on building a plain JavaScript crypto position-risk calculator, inspired by a personal $100 loss on a leveraged trade that lacked a stop-loss. The tool combines position quantity, entry price, stop price, trading fees, and a slippage buffer to estimate total dollar risk before an order is placed. Unlike leverage, which only determines the margin required, the actual dollar loss depends on the quantity of tokens and the price distance to the stop. The tutorial walks through a sample calculation where 1,500 tokens entered at $0.620 with a stop at $0.608 produce an $18 price loss, rising further once fees and slippage are added. The function also includes validation logic to catch a common error where a stop is placed on the wrong side of the entry price.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hugging Face Accelerate Flaw Allows Arbitrary File Read and DoS via Checkpoint Files

A path traversal vulnerability (CVE-2026-69112) has been discovered in Hugging Face Accelerate, affecting all versions up to and including 1.14.0. The flaw stems from the library's failure to sanitize filenames in the weight_map field of sharded checkpoint index files, allowing attackers to supply malicious paths that read arbitrary files from the host filesystem. A secondary attack vector exploits named pipes on Linux to cause indefinite process blocking, resulting in denial of service. The two affected functions — load_checkpoint_in_model and load_checkpoint_and_dispatch — are primary entry points used widely across ML pipelines, which collectively see roughly 27 million downloads per month. No patched version is available yet, and users are advised to manually validate checkpoint index files to reject entries containing parent-directory sequences or absolute paths.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds synthetic data tool after embarrassing demo with placeholder test data

A software developer created a test data generation tool called fundata.dev after a client demo exposed placeholder entries like 'Test User 1' and 'aaa@aaa.com' in a live dashboard. The tool generates reproducible, realistic synthetic data in multiple formats including SQL, JSON, and NDJSON to suit databases, mock APIs, and data pipelines. A key motivation was avoiding the legal risks of using real customer data in staging environments, which can violate privacy regulations like GDPR. The tool allows developers to define a schema once and generate thousands of rows with configurable NULL rates, helping surface bugs caused by edge cases such as apostrophes in names or unexpectedly long strings. The author notes that uniform test data masks entire categories of production bugs that only realistic, varied data can expose.

0 comments Read more at DEV Community