@fastify/secure-session Signature Verification Bypass and Session Invalidation Evasion (CVE-2026-117549)
Executive & SecOps Summary
SECOPS ASSESSMENTNode.js applications using @fastify/secure-session versions 7.5.0 through 8.4.1 configured with the signed cookie option
Attackers holding an expired or revoked session can strip the obsolete signature and continue using the session, bypassing session invalidation attempts that rely solely on rotating the cookie signing secret
Upgrade @fastify/secure-session to version 8.4.2 or later, or rotate the session encryption key instead of relying only on the cookie signing secret
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade @fastify/secure-session to the patched version (8.4.2 or later) to resolve the signature bypass flaw.
# Using npm
npm install @fastify/secure-session@8.4.2
# Using yarn
yarn upgrade @fastify/secure-session@8.4.2
# Using pnpm
pnpm update @fastify/secure-session@8.4.22. Temporary Workaround & Hardening Configuration
If upgrading the package is not immediately feasible, you must rotate the session encryption key rather than relying on the rotation of the cookie signing secret alone to invalidate existing sessions.
// Fastify Application Configuration (Workaround)
const fastify = require('fastify')();
const fs = require('fs');
fastify.register(require('@fastify/secure-session'), {
// CRITICAL: Rotate this encryption key to force-retire all existing sessions
key: fs.readFileSync('./path/to/new-encryption-key'),
cookie: {
path: '/',
signed: true
}
});3. Log Audit & IoC Verification Commands
Run the following commands to audit your project dependencies and detect vulnerable versions of @fastify/secure-session.
# Check the installed version of @fastify/secure-session
npm list @fastify/secure-session
# Verify vulnerability status via Node.js CLI
node -e "
try {
const pkg = require('@fastify/secure-session/package.json');
const current = pkg.version;
const [major, minor, patch] = current.split('.').map(Number);
if (major === 7 && minor >= 5 || major === 8 && minor < 4 || (major === 8 && minor === 4 && patch < 2)) {
console.error('[-] WARNING: Vulnerable @fastify/secure-session version detected: ' + current);
process.exit(1);
} else {
console.log('[+] SAFE: Installed version is secure: ' + current);
}
} catch (e) {
console.log('[+] Package not found or not installed in this path.');
}
"Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-117549) is a cryptographic signature verification bypass in @fastify/secure-session, a session management plugin for the Fastify framework that stores encrypted sessions in cookies.
In affected versions (7.5.0 through 8.4.1), when the plugin is configured with the signed cookie option, it calls the cookie unsign routine to verify integrity. However, even if the signature check fails and reports the value as invalid, the plugin erroneously passes the original cookie value to the session decoder anyway. This logic flaw allows unsigned or improperly signed cookies to be successfully decrypted and processed.
2. Exploitation Mechanics & Attack Scenario
The vulnerability manifests when an application manages the cookie signing secret independently of the session encryption key and attempts to retire active sessions by rotating only the signing secret.
- Session Acquisition: An attacker obtains a valid, encrypted, and signed session cookie through normal authentication.
- Signing Secret Rotation: The administrator rotates only the cookie signing secret to invalidate all existing sessions.
- Signature Stripping: The attacker strips the now-obsolete signature from their existing session cookie.
- Bypass & Access: The vulnerable plugin detects the signature mismatch but proceeds to decrypt the session payload anyway. The attacker successfully maintains their session state without possessing the new signing secret.
*Note: The attacker must already possess an unexpired encrypted session cookie and cannot forge session data, extend expiry, or survive rotation of the encryption key.*
3. Infrastructure & Business Impact
This flaw undermines session revocation mechanisms, which are critical during incident response or routine credential rotation. If an administrator attempts to force-logout users by rotating the signing secret, malicious actors or compromised sessions can persist, leading to unauthorized access and potential data exposure within enterprise environments.
Official Vendor Advisories & References
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.
Frequently Asked SecOps Questions (CVE-2026-117549)
FAQQ1. How critical is CVE-2026-117549 and is it actively exploited in the wild?
CVE-2026-117549 is rated CVSS 4.2 (MEDIUM) with a 30-day EPSS exploitation probability of 0.1%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-117549?
Primary impacted vendors include fastify across @fastify/secure-session. Scope summary: @fastify/secure-session versions 7.5.0 through 8.4.1 (when configured with signed cookies)
Q3. What temporary mitigations or workarounds exist for CVE-2026-117549 before patching?
[Mitigation] Upgrade @fastify/secure-session to version 8.4.2 or later, or rotate the session encryption key instead of relying only on the cookie signing secret Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-117549
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (fastify)
View Category →@fastify/reply-from Path Traversal and Proxy Bypass Vulnerability (CVE-2026-117518)
[Affected Scope] Node.js applications utilizing @fastify/reply-from versions up to and including 12.8.0
@fastify/multipart Denial of Service (DoS) Vulnerability via Unpropagated Parser Errors (CVE-2026-117531)
[Affected Scope] Fastify web applications utilizing @fastify/multipart versions 5.3.0 through 10.1.6
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.