CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-02
@fastify/secure-session Signature Verification Bypass and Session Invalidation Evasion (CVE-2026-117549)
[Affected Scope] Node.js applications using @fastify/secure-session versions 7.5.0 through 8.4.1 configured with the signed cookie option
[Impact] Attackers holding an expired or revoked session can strip the obsolete signature and continue using the session, bypassing session invalidation attempts that rely solely on rotating the cookie signing secret
[Mitigation] Upgrade @fastify/secure-session to version 8.4.2 or later, or rotate the session encryption key instead of relying only on the cookie signing secret