Session Management Vulnerability in Fastify's Secure Session Plugin

CVE-2026-117549

What is CVE-2026-117549?

The @fastify/secure-session plugin, used for managing sessions through encrypted cookies, is vulnerable to a session management flaw. In versions 7.5.0 through 8.4.1, a failure in the signed cookie validation allows attackers to bypass the session signature check and decrypt the session. This situation arises when applications utilize a separate cookie signing secret from the session encryption key. Consequently, if an old session cookie is retained, it can still be used by stripping its obsolete signature, enabling unauthorized access without knowledge of the encryption key. To mitigate this risk, it is critical to upgrade to version 8.4.2 or later, where the decoding of the session is prevented if the signature does not validate. Alternatively, users are advised to rotate their session encryption keys instead of relying solely on signing secret rotation.

References