Session Cookie Hijacking Vulnerability in Fastify Session Plugin by Fastify

CVE-2024-35220

What is CVE-2024-35220?

The session plugin for Fastify, @fastify/session, is susceptible to a session management vulnerability due to mishandled cookie expiration. The issue arises when restoring cookies from the session store, where the expires field may be incorrectly overridden if the maxAge field is set. This flaw prevents expired cookies from being recognized as such, leading to unrevoked sessions and increased risk of unauthorized access. Users are advised to update to version 10.8.0 or later to mitigate this concern.

References