Session Management Vulnerability in Fastify Plugin by Fastify

CVE-2026-117499

What is CVE-2026-117499?

The @fastify/session plugin for Fastify has a critical session management flaw that allows an attacker to replay valid signed session cookies. This occurs in all versions before 11.1.6 when the rolling session behavior is enabled. If a request is made to restore a session prior to a logout, the session identifier can be recreated with authenticated data, effectively bypassing the logout process. The vulnerability allows an attacker with an existing session cookie to restore access after a logout has been initiated, posing a serious security risk. The issue has been addressed in version 11.1.6 through the introduction of a per session generation marker and a conditional store write feature, which prevents the restoration of destroyed sessions. Users are strongly encouraged to upgrade to the latest version to safeguard their applications.

References